I know it's customary for HN to edit titles to remove extraneous information, but removing "Linux" here really takes away something useful and relevant. This is a Linux vulnerability. If you're running *BSD or Mac or Windows, not affected.
"Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath TCP listener," with no credentials. Go programs open those listeners by default, per the Go Security Team. See the timeline."
I don't know of any Linux boxes running a multipath TCP listener in my care and I have quite a few. MP generally implies a router of some sort and the intersections in a Venn diagram continue to get smaller ...
This is still an issue and must be patched but I think it will be rare, very rare.
1: https://groups.google.com/g/golang-announce/c/PCoQcdxoScw
MPTCP doesn’t use any specific ports. It’s an OSI layer higher than that. It’s part of the TCP protocol itself. So if your firewall routes TCP traffic of a specific port (eg HTTP) already then it’ll route MPTCP along with it too.
sudo ss -lnp -A mptcp
https://en.wikipedia.org/w/index.php?title=OOM&diff=prev&old...
- MPTCP is not a requirement, it is a generic use-after-free.
- Exploitability over the internet is unlikely, most ISP routers drop packets with IP options fields.
- At least according to Red Hat, dropping packets with IP options yourself helps, but is not a full mitigation.
- Successful exploit requires multiple CPU cores to process packets, so systems with just a single core or packet processing pinned to a single core are not affected.
That doesn't track. Apple iPhones are a major user of MPTCP and they report the majority of requests supporting MPTCP, IIRC 70+%.
What Apple does is, for example, being able to have a connection over WiFi and 5G simultaneously, with different IPs and routes.
The more traditional server side multipath is that you have a network card with 4 ports (eg 4x 25gbit) and connect them to a router, and make those 4 physical ports (paths) behave like a single interface. This helps either load balancing or redundancy.
The latter is what this vulnerability is about.
sudo tcpdump --immediate-mode -p -nn -i eth0 -vvv -c 1 'ip and (ip[0] & 0x0f > 5)'
to see if you even get them from upstream
SYN packet #1 is received and added to a request queue for processing.
SYN packet #2 is received and is a retransmit of SYN packet #1. It is matched to SYN packet #1 already in the request queue and now there is shared state between both SYN packets #1 and #2 in the request queue.
CPU #1 takes on the task of processing SYN packet #1.
CPU #2 takes on the task of processing SYN packet #2.
CPU #1 responds back with RST packet #1 (e.g. requested TCP port is not open) and _should_ defer the destruction of the request socket for SYN packet #1, as other CPUs may still be processing the shared state for the request socket as is the case for retransmitted SYN packets.[1] However, this deferred destruction wasn't occurring, and CPU #1 was _immediately_ destroying the request socket/shared state for SYN packet #1.
CPU #2 races with CPU #1 and reads from the request socket/shared state for SYN packet #1 after its _immediate_ destruction by CPU #1.
Linux's IPv6 handling is unaffected because in this IPv6 scenario, there is no shared state between SYN packets #1 and #2 in the request queue. Instead, each request socket has duplicate data.
Someone more knowledgeable can confirm/correct me on the above please.
[1] https://www.kernel.org/doc/html/latest/RCU/whatisRCU.html#rc...
The undocumented part (per LKML discussions at least) is what happens next in the attack. Seemingly CPU #2 or CPU #3[2] comes along later to process the random jibberish options header and rarely (in Anthropic's case it took 48min locally) that random jibberish will be returned to the attacker (e.g. copy jibberish options header to a response packet?) and it'll expose a return pointer to a fixed kernel function. The attacker then crafts a SYN packet and retransmits it with an options header that places a return pointer in the right place, and hopes for another race to occur where CPU #3[2] executes a callback to an attacker-controlled pointer stored within the options header data. Anthrophic's case said it took 5min for this stage of the attack to work locally.
Someone will probably write this all up at some point and it'll be quite a long and detailed read of how the 48min and 5min stages of the attack work and perhaps this is where MPTCP code paths are involved due to the way they process the TCP options header data.
[1] https://en.wikipedia.org/wiki/Internet_Protocol_Options
[1] Author of the kernel patch suggests that CPU #3 (three way race) is needed per https://lore.kernel.org/netdev/CAL4WiiroQ8XyDzUnmuy5FmJ4SWfZ...
> An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed. In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution
source: https://www.anthropic.com/research/discovering-vulnerabiliti...
For years, Red Hat employed more kernel developers than anyone and contributed more. These days they're "only" the fourth largest contributor, after Intel, Google, and Meta, but they are still among the largest corporate contributors.
If that's a lean kernel org, I don't know what a fat one would look like.
LTS doesn't work if you want immediate fixes like the current environment requires.
If they cannot demonstate being systematically able to adapt towards the required reaction time (minutes? hours?) by almost-comically many orders of magnitude (multiple weeks), and it is only going to get worse, then what other conclusion could there be?
Like they'll only organizationally adapt when it's far too late (everybody using their shit has already been pwned), and then it'll be an unpracticed emergency adaptation.
Ubuntu has had kernels in the "proposed" component for several days now if you want to pull it in manually. Not yet pushed to "security" or "updates".
https://ubuntu.com/project/docs/SRU/reference/sru-verificati...
or download the individual package (and dpkg --install ... but this doesn't check signatures)
https://ubuntu.pkgs.org/26.04/ubuntu-proposed-main-amd64/lin...
Don't trust Ubuntu's LTS promises, either. Most of the modern packages you care about are in universe, which almost never gets patched after the initial release.
I think they deliberately leave the free LTS version insecure in order to sell Pro licenses. But guess what, even Pro doesn't get timely patches.
RHEL runs with MP-TCP disabled by default, they initially listed it as Important only to later raise it to Critical.
https://forum.proxmox.com/threads/cve-2026-98432-in-proxmox-...
It went through internal QA and to the test soon after that, then a few days later to the no-subscription repository and as of yesterday morning CET it was cleared for the enterprise one, so it's available on all repos of all Products we got in their current supported releases.
For kernel updates we where even more conservative in the past, but with the current churn on often quite relevant fixes picked up the pace a bit on moving them along, trying still to balance rolling out fixes fast(er) while not doing that so fast that tricky (hardware/setup specific) regressions don't get caught.
edit: As this makes the rounds we also released a PSA for it now [0] to make our status here easier to find.
[0]: https://forum.proxmox.com/threads/proxmox-virtual-environmen...
IMNSHO this makes them unfit for purpose. I think this is the nail in the coffin for Ubuntu for me.
I pulled in from -proposed this time.
Ubuntu was slow on the brotli / CVE-2026-111497 updates as well.
No legit enterprise is running that clownware — ever.
Times can change.
"A significant problem, typically exploitable for nearly all users in a default installation of Ubuntu. Includes serious remote denial of service, local root privilege escalations, local data theft, and data loss."
The listed kernels are in the "proposed" component (and not yet in "security" or "udpates") if you want to pull them down onto canary systems for testing before going to production.
Is iptables considered an "application" here? I.e. can this bug be triggered before iptables drops the packet?
Illustrative example: This CVE in a Rust matrix transpose code: https://github.com/advisories/GHSA-5gmm-6m36-r7jh
Conceptually, there is not really anything much simpler than a matrix transpose. So how did they manage to create a bug? To make it fast you need simd, which implied using unsafe, and the dimension check to make it safe used unsigned integers that could wrap around. So they same bullshit as in C.
Rust can separate the question: "Is a set of functions is safe in a certain condition" from "using functions in that condition".
They are materially different. SIMD has a safe interface now.
Vibe code aside I feel targeted rewrites are becoming more and more justified.
The Linux maintainers have been extremely conservative with the Rust introduction but after the endless CVE apocalypse they might be more receptive.
Already happening. https://lwn.net/SubscriberLink/1102982/c3a3a2d4f17108c5/ "Removing binder.c" is an article from yesterday, about discarding the old C implementation of the Android Binder driver (used by every single Android phone) in favor of its Rust reimplementation.
Like are we empirically seeing less Rust CVEs? Adjusted for popularity of software and perhaps age of software.
The question is whether your software will be in use long enough to be worth the cost of change more than whether it's a good idea in the long run. For Linux, I'd argue that that's likely. At least new code would ideally be contributed in a safe language, where practically possible (there'll surely be places where you need to deal with memory as a kernel)
Relevant article: reducing memory vulnerabilities through a combination of memory-safe languages and an exponential decrease of bugs as existing code ages https://security.googleblog.com/2024/09/eliminating-memory-s..., from which I'll also quote my reference for [1]: "A large-scale study of vulnerability lifetimes published in 2022 in Usenix Security [...] found that the vast majority of vulnerabilities reside in new or recently modified code"
> AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway
> Customers using the above services do not receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self-managed instances behind these services within the next 30 days.
[0]: https://aws.amazon.com/security/security-bulletins/2026-160-...
[0]: https://www.anthropic.com/research/discovering-vulnerabiliti...
It would be great if they introduced mitigations for this vulnerability though.
Another reason NixOS will continue to grow :)
My list (of feeds) is still small, but this CVE did not show up, do any of you have any tips for RSS feeds to use for this purpose?
I don't know for sure, but over the past few months I've seen a bunch of skeptical people do a complete 180 and start using LLMs more actively.
_If you’d rather get messages in real time, you can subscribe to the list itself by sending an empty email to oss-security-subscribe@lists.openwall.com. Be aware that the volume is high; October 2026 alone had 460 messages._
That's also well into clanker managed territory ;) (I mean the clanker builds a small automation, no LLM involved after that, I do a lot of that, just use clanker to build, update, organize, monitor and handle edge cases.) I have used free (and therefore limited) agentmail.to for this. I find the subscription to be a bit expensive for my hobby, but it's a nice service if you do this professionally.
Simultaneously Wikipedia says the Act has "entered into force" in 2024. Does anyone know the difference between "enters into force" and "applies"? Is it like this 2016–2018 grace period for GDPR where it was "law" but not enforced? (The wording sounds backwards if it's that, but I'm not a native speaker)
but also this is one of those cases where, ok you have a law, but, that's meaningless. It's not enforceable. It's not even monitorable. It's nice in theory to write down a bunch of regulations but at best you can make a bunch of EU companies do some paperwork. anything imported from outside the EU, the company can agree to everything and then dissapear. ALl the direct to consumer slop on amazon and whatever. How is the EU supposed to enforce a law against a random fly by night brand name in Shenzhen?
From https://taxation-customs.ec.europa.eu/news/report-highlights...
> As volumes rise, enforcement is weakening. In 2025, the EU control rate fell to 65 items per million items imported. The rate of goods ultimately refused at the border due to non-compliance or because they posed serious risks, also fell to below 10 items per million.
> A large-scale customs investigation launched by the Commission in 2025 highlights the scale of the problem. Over 60% of checked toys, small electronics, cosmetics, personal protective equipment and food supplements bought online from outside the EU failed to meet EU product compliance and safety requirements.
It's just regulation theater. It's meaningless.
I ask because I’ve been dabbling in rooting various closed devices at home. I’m finding AI fantastic at finding vulnerabilities statically (from firmware upgrade binaries), but when you then ask it to use it to get root or code execution it just goes in circles.
In the end it usually ends up there’s no exploit it can find, because it can’t actually influence the affected memory in a useful way. This is especially so if that memory is in the heap. On the stack it’s a lot more predictable (especially with OOB writes).
From experience OpenAI and Anthropic have pretty heavy safeguards in recent (public) models.
How do you know which pointer (as I say, especially if it’s in the heap)? And I know it can go wrong - but how do you do more than just crash the kernel?
In OOB writes in a stack variable it’s completely clear to me. For other situations I’d love to find real and clearly explained exploits of past UAF or OOB vulnerabilities.
The simplest thing you could try to do is allocate several more of the same type of object and hope one of them lands at the same memory address. For example if you can UAF a web app's user session and keep it open for a long time period (not true in the TCP bug), you might try to wait until an admin happens to log in with their session at the same address, then use their admin session.
Or you can allocate a lot of something else objects and hope a certain field overlaps, like a function pointer if you can write to it. Like suppose you can get some kind of authentication callback pointer to overlap where your packet sequence number was, maybe you can send a certain number of packets to make it point to the return instruction and skip the authentication.
At a high level, though: once you've gotten a new object allocated where the old one was, you now have two different views of the same bit of memory. You use valid operations on one view to put the other one into a corrupted state. For example: in a unixlike kernel, maybe one view has a field containing a function pointer (for method dispatch, essentially). You read that field using the other view, use it to deduce something about the target's memory layout, write a new value to the pointer, then use the field via the first view to cause execution to jump to a location you control.
For example, I remember an exploit workshop around reuse of passwd entries. The vulnerable would validate a passwd entry for a non-root user, use it a bit, and later on free and zero it out for security purposes... except it then looked at the passwd entry again in some conditions. Suddenly, the uid was non-zero at first, and zero later on, so later decisions assumed the user was root.
In a more concurrent situation, a possible vulnerability was a shared cache of these passwd entries. It wouldn't zero them out anymore, but you could create a race condition of starting requests as user A, and then hammering requests as user B, so you'd end up mixing up the permission contexts of these users. Because the passwd entry that had been released back to the pool was overwritten, and then re-read with the value from another context.
The necessary line of thinking tends to be very different from thinking about program code regularly.
the model spins because it cant test its own guesses. what fixed it for me was emulating the actual device. qemu with the vendor rootfs, real binaries running, and then every claim becomes checkable: did the daemon actually parse my input, which uid is it under, what does its own log say. once it can check things it stops guessing, getting qemu to actually boot the thing was its own little hell though, took more tries than i want to admit.
the other thing i learned the hard way: most static findings die on reachability, not on exploit primitives. so i run them in the emulator first and kill the unreachable ones cheap, before spending any time on heap work
on heap vs stack, i think that intuition is desktop shaped. device userland usually has weak or no mitigations, heap uafs are way more tractable there than youd expect
Good ideas on the QEMU. I guess you’d have to patch the binary if it’s expecting particular hardware etc?
Not sure what you mean by “desktop shaped”?
Can you give a concrete example of UAF on heap? I’m learning a bit on how this is done, and eventually recognised the LLM is doing something called heap spray. But that seemed to rely on hoping some object you wrote just happened to get interpreted by some process. And that was the “no, wait, pointer f isn’t y” loops.
This is wild. I'm a firmware nerd, not a backend nerd, what percentage of TCP/IP servers are 'multipath'?
Also, since IPv6 isn't affected, wouldn't it be funny if this is what it took to get everyone to switch.
no idea, but at least Tailscale and Caddy were opening MPTCP sockets on servers I checked.
Every Ubuntu version in the last decade is currently vulnerable.
https://ubuntu.com/security/CVE-2026-98432
Patches not yet available. That makes this a big deal.
This article says that this isn’t app level but is level and can be exploited before requests reach apps.
I was talking about the Anthropic blog post, only Go/Caddy enable multipath TCP listeners by default.
Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection.
It reads like it was LLM generated though so who knows. There is at least a simple mitigation for Golang apps if that is the only concern.
Anthropic only exploited multipath TCP, but the bug is deeper and also affects TCP connections, but it looks like this path is harder to exploit, and it's unclear if anybody managed to.
At work we currently have a weekly release schedule but im going to push to speed it up because 1 week is far too long to leave packages out of date.
Random npm packages are another thing.
How does this cycle get broken?? Will people ever be able to be sold the (false idea) that their devices are secure?
The implications are extensive.
The models that many organisations and most individuals don't have access to?
7.3 (2026-10-18)
7.2.10 (2026-10-11)
6.18.56 (2026-10-11)
6.12.113 (2026-10-15)
6.6.159 (2026-10-15)
6.1.190 (2026-10-15)
5.15.225 (2026-10-15)
[1] https://lore.kernel.org/all/?q=tcp_v4_reqsk_destructor -- check for "kfree_rcu" being used instead of "kfree" within "tcp_v4_reqsk_destructor" (net/ipv4/tcp_ipv4.c)
actual link: https://nvd.nist.gov/vuln/detail/cve-2026-98432
If this requires a multi-core system to exploit, it's good news for most of the consumer routers that will never get updates. Saved by cheap single-core hardware.
Heck, apparently even the new Unifi UCG Fiber is running 5.4.213 (September 2022), but maybe they backport some fixes?
[1] https://community.ui.com/releases/dd0283dc-bf71-4140-ae1d-c1...
root@OpenWrt2:~# ss -Qlnt4 'src 0.0.0.0'
State Local Address:Port Peer Address:Port
LISTEN 0.0.0.0:443 0.0.0.0:*
LISTEN 0.0.0.0:80 0.0.0.0:*
LISTEN 0.0.0.0:22 0.0.0.0:*[1] Yes, it seems that they are still on 6.12.112, but they'll probably roll out an update quickly. Also see: https://forum.openwrt.org/t/cve-2026-98432-kernel-update-or-...
root@OpenWrt2:~# lscpu
Architecture: mips
Byte Order: Little Endian
CPU(s): 4
On-line CPU(s) list: 0-3
Model name: -
Model: MIPS 1004Kc V2.15
Thread(s) per core: 2
Core(s) per socket: 2
Socket(s): 1An entire ecosystem of malware crawling and cohabiting in them.
If you have services open on the IPv4 net however, close them immediately as a precaution.
https://www.reddit.com/r/openwrt/comments/1xka85h/is_the_ope...
They say 25.12-SNAPSHOT has it fixed
Multipath TCP is a neat trick that allows a single TCP connection (TCP = Transport Control Protocol, a stateless protocol for long running connections) to use multiple physical interfaces. You could do something similar before MTCP using bonding, but this was annoying to set up and usually required application level code to efficiently use the bonded connection. MTCP makes this much simpler from an application level point of view and it can use widely diverse underlying transport layers at the same time (for instance, WiFi, Cellular and wired connections).
TCP is stateful by definition, and that is why it supports robust error correction and reliable streams of data. UDP is its stateless counterpart.
> bonding, ... usually required application level code
No, it doesn't. https://en.wikipedia.org/wiki/Link_aggregation
> underlying transport layers
TCP is in the transport layer! The layers which you name are lower, such as Layer 2 (Data Link)!
MTCP, being in the transport layer, is working at a higher level of abstraction than bonding or link aggregation. There is no need for application-layer support, but it is possible, and easier, with MTCP than with the Layer 2 solutions, because MTCP is in the transport layer. That is why Go was able to activate it, and the POC uses it, because MTCP controls can be exposed at that level.
It's an extension to TCP that, similar to QUIC, allows you to use multiple address/port pairs to transmit data over a single logical stream. Both client/initiator and server/listener have to opt into the extension. This might need to be enabled explicitly by the application[1], which Go apparently does for you, or judging from other posts may be enabled by default systemwide, depending on your platform.
AFAIU, a major user of MPTCP is Apple and the iPhone, and the ubiquity of iPhone clients motivated implementation in and deployment on Linux servers.
[1] https://docs.kernel.org/networking/mptcp.html#sockets-api
Again, the description of this CVE indicates that the vulnerability does not depend on MPTCP. But it is a factor in the proof-of-concept and its likelihood of success.
So if there was any widespread mutual support of MPTCP, it may shrink significantly as network admins deploy mitigations.
The discourse on this is weird, sounds at times as if these are “because of AI.” These are mostly pre-existing bugs, some very old, and they’ve been lurking. If they all get found we exit the other side more secure and reliable.
The next few years will be crazy, but you're right, we'll come out the other side more secure than ever before. Just gotta make it that far!
I agree, but as yet we have no idea how much pain we have to pass through to get to the other side.
# CONFIG_MPTCP is not set
Watch your Linux systems for kernel updates. Reboot!
As part of the Software Building Code (that we don't have, and desperately need), one of the things we should have is mitigation for these abandoned internet safety risks. Here's how I would define that section:
Section 4 Connections to Public Internet
Section 4.1 Device Support
Devices connected to the public internet WILL require one of the following:
a) Guaranteed LTS support for a minimum of 10 years
b) Guaranteed rolling release support for a minimum of 10 years
Devices without this support are not permitted to be connected to the public internet.
Section 4.2 Vendor Responsibility
When releasing devices, vendors must determine whether this device is certified for
public internet use. Support must be maintained according to S4.1. Failure to comply will
result in fines of up to $5,000 per affected device.
Section 4.3 Installer Responsibility
Any device connected to the public internet which is not certified for public internet
use is in violation, and will be subject to fines of up to $500 per affected device.
Section 4.4 Device Owner Responsibility
Any installed devices will be replaced once they reach their End Of Life period,
or after 10 years, whichever comes first. Installed devices in use that exceed this
period are in violation, and subject to fines of up to $250 per affected device.
% uname -a
Linux XXXX 5.15.223 #1 SMP PREEMPT Thu Oct 22 00:03:07 CDT 2026
x86_64 Intel(R) Core(TM) i7-4810MQ CPU @ 2.80GHz GenuineIntel GNU/Linux # CVE-2026-98432 mitigation: drop TCP packets carrying IPv4 extended options
-A ufw-before-input -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP
This works for me on multiple servers and home desktops and my hardware linux firewall/router. I did it a couple days ago when this was first announced. The iptables counter for matches haven't gone up at all on my VPS servers that gets lots of traffic. The counter only goes up when I manually trigger it to test. Everything continues to work nominally with these in place.
(reading TFA)
net/ipv4/af_inet.c
net/ipv4/tcp_ipv4.c
And moreover it's a security issue found by LLMs.
It's kinda a really bad time to be a C-loving, AI-hating, fanboi.
Do we at least entertain the idea that some rewrites of some things in safer languages could be a desirable goal? (not saying it's practical or not: just asking if C lovers are willing to reflect a bit on what's going on atm).
i’d focus on writing new stuff with rust though, not rewriting old stuff
and time will tell whether it actually reduces bugs or just change the failure modes to something else
also C will always be there in some way or the other, at least in conventions and syntax
I see. https://nvd.nist.gov/vuln/detail/cve-2026-98432 affected versions format is the culprit. Entirely unusable. We do have versions, branch names and tags for a reason.