What happened (in plain, slightly terrified English)

A nasty bug was found in the Linux kernel networking code that can let an outsider run commands as root on some servers. Tracked as CVE-2026-98432, the issue is a classic use-after-free problem buried in IPv4/TCP handling. The kernel team rated it extremely dangerous, and it shows up in many kernels going back years (think: kernels since 4.4).

Under certain timing conditions — a race while the kernel is juggling SYN requests and replies — memory that it still expects to use can be freed and then reused. That lapse can be turned into more than a simple crash. Security researchers demonstrated a full exploit against machines running an MPTCP listener: an AI-assisted proof-of-concept bypassed KASLR and obtained root on a vulnerable box in roughly an hour.

Important note: the bug can be triggered without logging in, and it affects regular TCP too, though remote code execution has only been publicly shown against servers using MPTCP listeners so far. Some vendors call the exploitation complex and emphasize it may only cause denial-of-service in many situations, but the demo shows escalation to remote root is possible when conditions line up.

What to do right now (your five-minute survival checklist)

If you run Linux servers, especially public-facing ones, treat this like a hot potato. Vendors are rolling out kernel updates, but not every distribution has pushed fixes yet. Until your distro ships a patched kernel, harden and limit exposure.

  • Check your distro’s advisories and install kernel updates as soon as they appear. When the patch arrives, update and reboot.
  • If you can’t patch immediately, restrict access: limit listeners to trusted networks, whitelisting IPs where feasible.
  • Consider firewalling rules that drop IPv4 TCP packets containing IP options before the kernel processes them — this has been suggested as a temporary mitigation. Remember, disabling MPTCP alone is not guaranteed to stop the issue.
  • Audit services built with newer runtimes: for example, some Go versions enable MPTCP support by default for TCP listeners, so you might have listeners you didn’t know about.
  • Monitor for suspicious activity, and be ready to isolate or reboot affected hosts if you suspect exploitation. There are no confirmed wide-scale attacks at the moment, but that can change fast.

In short: apply patches when available, tighten network exposure in the meantime, and keep an eye on kernel updates from your distribution. The bug is gnarly but manageable if you act quickly — and if you enjoy mild paranoia, this is a good day to practice it.