With a disputed rating ranging from 7.0 (Amazon) to 8.1 (Red Hat advisory position), and to 9.8 (kernel CNA) ¹ , the CVE-2026-98432 is a critical use after free in the Linux kernel’s IPv4 TCP handshake code, present since Linux 4.4. It is mainly known as MPTCP-specific because of the Anthropic report, but the vulnerable path runs on any listening IPv4 TCP service. What specifically needs an MPTCP listener is Anthropic’s proof of concept².

How it works

1. The client starts a TCP connection carrying IPv4 IP options, for example Record Route and Timestamp. The kernel saves those options against the half-open request and waits for the final ACK;
2. the handshake completes, tcp_v4_syn_recv_sock() creates a child socket, and hands the same options to inet_opt without copying them. Request socket and child socket now share one object;
3. a race starts, a second CPU execution handles a retransmitted SYN for the same request, and builds a SYN-ACK from those options under RCU (Read Copy Update); ip_build_and_send_pkt() and ip_options_build() both read optlen;
4. because inet_sock_destruct() frees inet_opt immediately with kfree() instead of waiting for RCU readers, the race becomes a use-after-free, causing either a kernel crash, a memory disclosure to the peer via the outgoing SYN-ACK or an out-of-bounds corruption when building it. Basically, if the new connection socket is torn down quickly enough, its options get freed while the other CPU execution unit is still reading them;
5. if net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE migration program is loaded, this attack can happen also during a request-socket migration as tcp_v4_reqsk_destructor() has the same immediate kfree();
6. IPv6 is not affected by the primary issue, as tcp_v6_syn_recv_sock() copies the options. Its migration variant only affects CALIPSO IPv6 options ³, which are left for a separate kernel patch.

The race was introduced in 2015 by commit 079096f103fa; the fix is Eric Dumazet’s e3f33b0a1d89, changing kfree() to kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor().

Successful attack possible consequences

• kernel crash, although some lengths can stop the kernel (so a failed race is not guaranteed safe);
• Kernel memory disclosure to the peer via SYN-ACK, which can bypass KASLR (Kernel Address Space Layout Randomization);
• Kernel memory corruption (out-of-bounds reads/writes);
• On MPTCP listeners only ²: demonstrated/possible execution of arbitrary commands as root;
• Anthropic claims that a lost race need not crash the host; however, with certain option lengths it may trigger skb_under_panic (kernel panic).

Check if you are exposed

• uname -r — compare with your distro’s fixed version
• ss -Mlnp — actual MPTCP listeners; patch these hosts first
• sysctl net.mptcp.enabled — 1 means apps may open MPTCP sockets
• sysctl net.ipv4.tcp_migrate_req — 1 enables a second affected code path

Fix

Fixed in upstream kernels below, distribution kernels may backport the same fix, so compare package/advisory versions too:

• 5.10.272
• 5.15.223
• 6.1.190
• 6.6.159
• 6.12.113
• 6.18.56
• 7.2.10
• 7.3

Mitigations

Disabling MPTCP alone is not a full mitigation; until patched, also:

• keep MPTCP listeners off the internet;
• treat internet-facing IPv4 TCP hosts as exposed;
• disable net.ipv4.tcp_migrate_req if unused, and remove unneeded BPF_SK_REUSEPORT_SELECT_OR_MIGRATE programs;
• for Go 1.24+ services: add the environment variable GODEBUG=multipathtcp=0, or add godebug multipathtcp=0 to the main module’s go.mod, or selectively call SetMultipathTCP(false) on the targeted listener/dialer;
• close the known exploit path:
  • only during runtime: sysctl -w net.mptcp.enabled=0
  • persistent (after reboot): echo "net.mptcp.enabled = 0" | tee /etc/sysctl.d/99-disable-mptcp.conf && sysctl --system (May break apps that explicitly require MPTCP; sysctl may not propagate across network namespaces.)
• Optionally drop inbound IPv4 TCP with IP options (community mitigation scripts).
• not strictly a mitigation for this issue, but useful hardening parameters you might want to add as kernel arguments: https://secureblue.dev/articles/kargs#standard

References / Footnotes

• Hacker News - Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
• Reddit post
• SavvyNik video