- MPTCP is not a requirement, it is a generic use-after-free.
- Exploitability over the internet is unlikely, most ISP routers drop packets with ipoptions fields.
- At least according to Red Hat, dropping packets with ipoptions yourself helps, but is not a full mitigation.
- Successful exploit requires multiple CPU cores to process packets, so systems with just a single core or packet processing pinned to a single core are not affected.
Going by the proxmox forum the fix is already in the sources (proxmox released their kernel based on them a few days ago). But I could not see, if it is already released for the users.
Yes, we fixed this in 7.0.14-25 initially packaged two weeks ago.
It went through internal QA and to the test soon after that, then a few days later to the no-subscription repository and as of yesterday morning CEST it was cleared for the enterprise one, so it's available on all repos we got.
I’m pretty confused because apparently Anthropic is the group that followed “responsible disclosure” but apparently even though upstream was patched a couple weeks ago, still nothing on either.
Can anyone explain how user after free results in a practical exploit?
I ask because I’ve been dabbling in rooting various closed devices at home. I’m finding AI fantastic at finding vulnerabilities statically (from firmware upgrade binaries), but when you then ask it to use it to get root or code execution it just goes in circles.
In the end it usually ends up there’s no exploit it can find, because it can’t actually influence the affected memory in a useful way. This is especially so if that memory is in the heap. On the stack it’s a lot more predictable (especially with OOB writes).
One example is that you might be able to read what was written there. Here that may mean you could read another process’s packet(s). Imagine they were sending unencrypted passwords, perhaps because it’s in a trusted LAN connection.
At least if you’re on Amazon Web Services behind a load balancer you probably aren’t really that impacted enough to spend Halloween patching.
> AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway
> Customers using the above services do not receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self-managed instances behind these services within the next 30 days.
OpenWrt doesn't open ports by default so I think the impact is minimal, unless this can breach nftables as well. CGNAT also mitigates this as a side effect.
If you have services open on the IPv4 net however, close them immediately as a precaution.
> Anthropic says Claude wrote the exploit "after initial prompting," that it runs "arbitrary commands as root, without any credentials or user interaction" on servers with a multipath TCP listener, and that in its proof of concept "it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution."
This is wild. I'm a firmware nerd, not a backend nerd, what percentage of TCP/IP servers are 'multipath'?
Also, since IPv6 isn't affected, wouldn't it be funny if this is what it took to get everyone to switch.
My understanding is that an app explicitly needs to open a "multipath" socket. Go 1.24 does that by default, so does Caddy, these would be the big ones.
Anthropic only exploited multipath TCP, but the bug is deeper and also affects TCP connections, but it looks like this path is harder to exploit, and it's unclear if anybody managed to.
Thanks. Expanding exploits is something LLMs seem pretty good at so I’d expect people to manage a more general exploit soon if not already. Hopefully it’ll be patched before that happens.
>the kernel handed those saved options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a handshake reply.
If this requires a multi-core system to exploit, it's good news for most of the consumer routers that will never get updates. Saved by cheap single-core hardware.
You would be surprised. A lot of cheap consumer routers are have two or four ARM cores. The bigger issue is that they are typically running a kernel from the stone age (< 6.0.0). Sometimes a still-supported LTS kernel like 5.10 or 5.15, but then they stopped at an old patch level.
Heck, apparently even the new Unifi UCG Fiber is running 5.4.213 (September 2022), but maybe they backport some fixes?
A listener is a piece of software that advertises itself as available to inbound connections. You can do this on a variety of protocols.
Multipath TCP is a neat trick that allows a single TCP connection (TCP = Transport Control Protocol, a stateless protocol for long running connections) to use multiple physical interfaces. You could do something similar before MTCP using bonding, but this was annoying to set up and usually required application level code to efficiently use the bonded connection. MTCP makes this much simpler from an application level point of view and it can use widely diverse underlying transport layers at the same time (for instance, WiFi, Cellular and wired connections).
It's an extension to TCP that, similar to QUIC, allows you to use multiple address/port pairs to transmit data over a single logical stream. Both client/initiator and server/listener have to opt into the extension. This might need to be enabled explicitly by the application[1], which Go apparently does for you, or judging from other posts may be enabled by default systemwide, depending on your platform.
AFAIU, a major user of MPTCP is Apple and the iPhone, and the ubiquity of iPhone clients motivated implementation in and deployment on Linux servers.
I had to look it up too since I hadn't heard of it. It's an extension to TCP that allows responses across different NICs. Sort of like Link Aggregation on to a switch, except it can go out dissimilar interfaces, like your wifi connection and your hardwired connection. Looks like you have to opt into it when you set up your socket: https://docs.kernel.org/networking/mptcp.html
In addition to aggregating, it can also be useful in cases where one link is much slower or higher latency. For example, if you're sitting in your driveway trying to get directions in maps while your phone is still on your very weak wifi network, it's a better user experience to have it to attempt the request using both radios concurrently so that it can fallback to cellular without waiting for a timeout/connection error if you're too far for wifi to actually work well.
2027 is going to be the year of two to three major CVEs per day.
The discourse on this is weird, sounds at times as if these are “because of AI.” These are mostly pre-existing bugs, some very old, and they’ve been lurking. If they all get found we exit the other side more secure and reliable.
Some notes I've got about this:
- MPTCP is not a requirement, it is a generic use-after-free.
- Exploitability over the internet is unlikely, most ISP routers drop packets with ipoptions fields.
- At least according to Red Hat, dropping packets with ipoptions yourself helps, but is not a full mitigation.
- Successful exploit requires multiple CPU cores to process packets, so systems with just a single core or packet processing pinned to a single core are not affected.
> Exploitability over the internet is unlikely, most ISP routers drop packets with ipoptions fields.
That doesn't track. Apple iPhones are a major user of MPTCP and they report the majority of requests supporting MPTCP, IIRC 70+%.
MPTCP uses TCP options fields, the vulnerability is in IP options.
FYI, the linked source spun up my fans with 100% GPU utilization. Is there some... unwelcome... script running?
How are Ubuntu and RHEL not fixed? Few operating systems market themselves more as suitable for servers. What are they doing over there?
Going by the proxmox forum the fix is already in the sources (proxmox released their kernel based on them a few days ago). But I could not see, if it is already released for the users.
https://forum.proxmox.com/threads/cve-2026-98432-in-proxmox-...
Yes, we fixed this in 7.0.14-25 initially packaged two weeks ago.
It went through internal QA and to the test soon after that, then a few days later to the no-subscription repository and as of yesterday morning CEST it was cleared for the enterprise one, so it's available on all repos we got.
I’m pretty confused because apparently Anthropic is the group that followed “responsible disclosure” but apparently even though upstream was patched a couple weeks ago, still nothing on either.
Running regression tests I assume; they can't just YOLO shit like most OSS projects for the exact reason you mention.
For a month?
No patches for Ubuntu or red hat yet.
https://ubuntu.com/security/CVE-2026-98432
https://access.redhat.com/security/cve/cve-2026-98432
so just block multipath and add the firewall rule from article that drops packets with IPv4 options
Both of which we are finding out are apparently insufficient to mitigate this.
Hoping fix will be out soon so we don’t have to.
Everything talks about this in terms of servers, but what about desktop Linux in typical setups? Consumer modems and routers? IoT junk?
IoT devices will get fixes delivered on the 12th of never.
But are they vulnerable to this specifically in typical setups?
Without a test-case, read POC, how do I verify if my server is affected?
Can anyone explain how user after free results in a practical exploit?
I ask because I’ve been dabbling in rooting various closed devices at home. I’m finding AI fantastic at finding vulnerabilities statically (from firmware upgrade binaries), but when you then ask it to use it to get root or code execution it just goes in circles.
In the end it usually ends up there’s no exploit it can find, because it can’t actually influence the affected memory in a useful way. This is especially so if that memory is in the heap. On the stack it’s a lot more predictable (especially with OOB writes).
One example is that you might be able to read what was written there. Here that may mean you could read another process’s packet(s). Imagine they were sending unencrypted passwords, perhaps because it’s in a trusted LAN connection.
At least if you’re on Amazon Web Services behind a load balancer you probably aren’t really that impacted enough to spend Halloween patching.
> AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway
> Customers using the above services do not receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self-managed instances behind these services within the next 30 days.
[0]: https://aws.amazon.com/security/security-bulletins/2026-160-...
I'm more worried about my consumer-grade router.
Another reason hyperscaler cloud providers will continue to grow (IMO)!
Is OpenWRT affected? Because that would be a real fawkin problem.
OpenWrt doesn't open ports by default so I think the impact is minimal, unless this can breach nftables as well. CGNAT also mitigates this as a side effect.
If you have services open on the IPv4 net however, close them immediately as a precaution.
As much as I hate to link to this site, this particular sub is very good:
https://www.reddit.com/r/openwrt/comments/1xka85h/is_the_ope...
They say 25.12-SNAPSHOT has it fixed
> Anthropic says Claude wrote the exploit "after initial prompting," that it runs "arbitrary commands as root, without any credentials or user interaction" on servers with a multipath TCP listener, and that in its proof of concept "it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution."
This is wild. I'm a firmware nerd, not a backend nerd, what percentage of TCP/IP servers are 'multipath'?
Also, since IPv6 isn't affected, wouldn't it be funny if this is what it took to get everyone to switch.
> what percentage of TCP/IP servers are 'multipath'?
no idea, but at least Tailscale and Caddy were opening MPTCP sockets on servers I checked.
My understanding is that an app explicitly needs to open a "multipath" socket. Go 1.24 does that by default, so does Caddy, these would be the big ones.
Your understanding seems to be wrong.
Every Ubuntu version in the last decade is currently vulnerable.
https://ubuntu.com/security/CVE-2026-98432
Patches not yet available. That makes this a big deal.
This article says that this isn’t app level but is level and can be exploited before requests reach apps.
> on servers with a multipath TCP listener
I was talking about the Anthropic blog post, only Go/Caddy enable multipath TCP listeners by default.
Well somebody is wrong, this blog post says:
Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection.
It reads like it was LLM generated though so who knows. There is at least a simple mitigation for Golang apps if that is the only concern.
Both are correct :)
Anthropic only exploited multipath TCP, but the bug is deeper and also affects TCP connections, but it looks like this path is harder to exploit, and it's unclear if anybody managed to.
Thanks. Expanding exploits is something LLMs seem pretty good at so I’d expect people to manage a more general exploit soon if not already. Hopefully it’ll be patched before that happens.
>the kernel handed those saved options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a handshake reply.
If this requires a multi-core system to exploit, it's good news for most of the consumer routers that will never get updates. Saved by cheap single-core hardware.
You would be surprised. A lot of cheap consumer routers are have two or four ARM cores. The bigger issue is that they are typically running a kernel from the stone age (< 6.0.0). Sometimes a still-supported LTS kernel like 5.10 or 5.15, but then they stopped at an old patch level.
Heck, apparently even the new Unifi UCG Fiber is running 5.4.213 (September 2022), but maybe they backport some fixes?
[1] https://community.ui.com/releases/dd0283dc-bf71-4140-ae1d-c1...
Those routers probably have 20 other critical un-patched exploits ...
An entire ecosystem of malware crawling and cohabiting in them.
Some previous discussion: https://news.ycombinator.com/item?id=50299182
What is a "multipath TCP listener"?
A listener is a piece of software that advertises itself as available to inbound connections. You can do this on a variety of protocols.
Multipath TCP is a neat trick that allows a single TCP connection (TCP = Transport Control Protocol, a stateless protocol for long running connections) to use multiple physical interfaces. You could do something similar before MTCP using bonding, but this was annoying to set up and usually required application level code to efficiently use the bonded connection. MTCP makes this much simpler from an application level point of view and it can use widely diverse underlying transport layers at the same time (for instance, WiFi, Cellular and wired connections).
See https://en.wikipedia.org/wiki/Multipath_TCP
It's an extension to TCP that, similar to QUIC, allows you to use multiple address/port pairs to transmit data over a single logical stream. Both client/initiator and server/listener have to opt into the extension. This might need to be enabled explicitly by the application[1], which Go apparently does for you, or judging from other posts may be enabled by default systemwide, depending on your platform.
AFAIU, a major user of MPTCP is Apple and the iPhone, and the ubiquity of iPhone clients motivated implementation in and deployment on Linux servers.
[1] https://docs.kernel.org/networking/mptcp.html#sockets-api
I had to look it up too since I hadn't heard of it. It's an extension to TCP that allows responses across different NICs. Sort of like Link Aggregation on to a switch, except it can go out dissimilar interfaces, like your wifi connection and your hardwired connection. Looks like you have to opt into it when you set up your socket: https://docs.kernel.org/networking/mptcp.html
You have a Wifi network interface and a wired Ethernet one, multipath is somehow combining the two together.
In addition to aggregating, it can also be useful in cases where one link is much slower or higher latency. For example, if you're sitting in your driveway trying to get directions in maps while your phone is still on your very weak wifi network, it's a better user experience to have it to attempt the request using both radios concurrently so that it can fallback to cellular without waiting for a timeout/connection error if you're too far for wifi to actually work well.
2027 is going to be the year of two to three major CVEs per day.
The discourse on this is weird, sounds at times as if these are “because of AI.” These are mostly pre-existing bugs, some very old, and they’ve been lurking. If they all get found we exit the other side more secure and reliable.
If I am reading this right, Slackware 15.0 is already fixed:
Oh joy.
MikroTik routers seem affected but mitigations are available.
Watch your Linux systems for kernel updates. Reboot!
If you use sysctl to disable mptcp, you need to do that again after each reboot.
How are people finding Fil-C? It's designed to avoid things like this.