Linux Flaw Requires MPTCP Listening, 慢雾 CISO 23pds Says

慢雾 CISO 23pds said claims that CVE-2026-98432 gives every Ubuntu system a zero-click path to root overstate the Linux flaw. Exploitation requires a server configured to listen for Multipath TCP (MPTCP), a feature Linux does not enable by default.

The vulnerability is a use-after-free race during an IPv4 TCP handshake in Linux’s network stack, not in a specific application, 23pds said. The assessment does not establish what level of access exploitation could achieve on a server configured to listen for MPTCP.

As of Oct. 30, Debian 12 and 13 had released fixes. Work on fixes for Ubuntu 22.04, 24.04 and 26.04 remained in progress, while fixes for Red Hat Enterprise Linux 8, 9 and 10 had been deferred.

23pds said they had not seen official confirmation of large-scale exploitation in the wild. 23pds’ clarification adds configuration context to Anza’s earlier warning to Solana validators about the Linux flaw, which recommended restricting incoming connections and disabling two networking features while operators awaited a kernel patch.