Linux kernel MPTCP flaw reportedly allows remote root via exploit by Anthropic researchers

Summary

According to BleepingComputer, Anthropic security researchers developed an exploit for a critical Linux kernel flaw in Multipath TCP. The item says the flaw lets unauthenticated remote attackers run commands as root on servers with MPTCP listeners.

If you use Linux

Check whether MPTCP is enabled on your servers (net.mptcp.enabled sysctl)

Apply the kernel patch from your distribution as soon as it is available

Restrict network access to exposed MPTCP listeners until patched

Monitor servers for unexpected root-level process activity

Timeline

Oct 30, 2026, 9:09 PM UTCMade public by BleepingComputer
Oct 30, 2026, 9:20 PM UTCFirst seen by cve.now1 day
Oct 31, 2026, 8:02 PM UTCRecord last updated

What the sources say 6

Oct 30, 2026, 9:09 PM UTC · BleepingComputer: “Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners.” Source

Oct 31, 2026, 2:01 PM UTC · Mastodon: “In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets” Source

Oct 31, 2026, 2:01 PM UTC · Mastodon: “In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer” Source

Oct 31, 2026, 2:01 PM UTC · Mastodon: “In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize” Source

Oct 31, 2026, 3:01 PM UTC · Mastodon: “Linux CVE-2026-98432 is a TCP use-after-free.” Source

Oct 31, 2026, 8:01 PM UTC · Mastodon: “CISA added the Fragnesia Linux kernel flaw (CVE-2026-46300) to its KEV catalog after reports of it being chained with PHP2Shell for remote root access.” Source