Anthropic xavfsizlik tadqiqotchilari Multipath TCP (MPTCP) tinglovchilari ishlaydigan serverlarda autentifikatsiyasiz hujumchilarga root sifatida masofadan buyruqlarni bajarishga imkon beradigan Linux yadrosi zaifligi uchun eksploit ishlab chiqdilar.
CVE-2026-98432 sifatida kuzatiladigan bu kamchilik oddiy TCP ulanishlariga ham ta'sir qiladi, garchi MPTCP tinglovchisi bo'lmagan serverlarda masofadan kod bajarish ommaviy ravishda namoyish etilmagan bo'lsa-da.
Multipath TCP (MPTCP) — bu bitta ulanish bir vaqtning o'zida bir nechta tarmoq yo'llaridan foydalanib, ishlash va ishonchlilikni yaxshilashga imkon beradigan TCP xususiyati. U qurilmalar bir nechta tarmoq ulanishlariga, masalan Wi-Fi va uyali tarmoqlarga ega bo'lgan muhitlarda keng qo'llaniladi.
CVE-2026-98432 — bu Linux yadrosi CVE jamoasi tomonidan 10 dan 9,8 ballik jiddiylik bahosini olgan yadro IPv4 TCP tarmoq kodidagi use-after-free zaifligi.
Zaiflik 4.4 versiyasidan boshlab Linux yadrolariga ta'sir qiladi, jumladan Ubuntu, Red Hat Enterprise Linux (RHEL) va Rocky Linux kabi keng tarqalgan tarqatishlar.
Linux yadrosi maslahatiga ko'ra, zaiflik yadro TCP ulanish so'rovlarini qayta ishlashdagi poyga sharoitidan kelib chiqadi va bu use-after-free holatiga olib kelishi mumkin.
"tcpv4synrecvsock() ireq->ireqopt egaligini nusxa ko'chirmasdan bola soketga (newinet->inetopt) o'tkazadi," deb o'qiladi maslahatda.
"Boshqa CPU bir xil so'rov soketi uchun qayta yuborilgan SYN ni bir vaqtda qayta ishlashi va tcpcheckreq() dan SYNACK yuborishi mumkin. tcpv4sendsynack() va inetcskroutereq() ireq->ireqopt ni faqat rcureadlock() ostida o'qiydi, va ipbuildandsendpkt() hamda ipoptions_build() keyin opt->optlen ni ikki marta o'qiydi."
Shunga o'xshash muammo net.ipv4.tcpmigratereq yoqilganida yoki BPFSKREUSEPORTSELECTOR_MIGRATE dasturi ishlatilganda TCP so'rov soketi migratsiyasi paytida ham yuz berishi mumkin.
Zaiflikni ishga tushirish autentifikatsiya talab qilmasa-da, Red Hat poyga sharoitini ishlatish shunchaki zararli tarmoq paketini yuborishdan murakkabroq ekanligini aytadi.
Red Hat zaiflikni potentsial xizmat rad etish muammosi sifatida tasniflaydi, bu yadro ishdan chiqishiga olib kelishi mumkin va ishlatish murakkabligi tufayli 5,9 ballik pastroq jiddiylik bahosini beradi.
Biroq Anthropic tadqiqotchilari zaiflik ma'lum sharoitlarda masofadan kod bajarish uchun ishlatilishi mumkinligini namoyish etdilar.
Anthropic hisobotida aytilishicha, e'lon qilinmagan Claude AI modeli yadro manzil maydoni tartibsizlashtirishni (KASLR) chetlab o'tadigan va MPTCP tinglovchisi ishlaydigan Linux serverda root sifatida ixtiyoriy buyruqlarni bajaradigan eksploit ishlab chiqqan.
Anthropic ma'lumotiga ko'ra, eksploit masofadan root kod bajarishiga erishish uchun taxminan 53 daqiqa vaqt olgan, bu zaiflik xizmat rad etish hujumlaridan ko'proq maqsadlarda ishlatilishi mumkinligini ko'rsatadi.
MPTCP odatda ilovalarda sukut bo'yicha yoqilmagan bo'lsa-da, ba'zi dasturiy ta'minot uni avtomatik ravishda yoqadi.
Go 1.24 dan boshlab, dasturlash tili Linuxda TCP tinglovchilari uchun MPTCP ni yadro bu xususiyatni qo'llab-quvvatlasa, sukut bo'yicha yoqadi. Shu sababli, ba'zi Go asosidagi tarmoq xizmatlari administratorlar bilmasdan MPTCP tinglovchilarini yoqishi mumkin.
Linux tarqatishlari yamoqlarni chiqarishni boshladi
Zaiflik yuqori oqim Linux yadrosida tuzatildi va saqlanadigan yadro tarmoqlariga orqaga ko'chirildi. Biroq xavfsizlik yangilanishlari hali ham barcha ta'sirlangan Linux tarqatishlariga tarqatilmagan.
Canonical xavfsizlik kuzatuvchisiga ko'ra, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS va 26.10 hali ham zaif, yadro tuzatishlari 30-oktabr holatiga ko'ra jarayonda.
Red Hat ham RHEL 8, 9 va 10 ni ta'sirlangan deb ro'yxatga olgan, tuzatishlar kelajakdagi yangilanishlar uchun rejalashtirilgan. RHEL 7 ta'sirlanmagan, chunki uning yadrosi zaif kodni o'z ichiga olmaydi.
Yumshatish yo'riqnomasida, Rocky Linux qo'llab-quvvatlash provayderi CIQ Rocky Linux 8, 9 va 10 ham ta'sirlanganligini tasdiqlaydi va ta'sirlangan tizimlar uchun vaqtinchalik xavfsizlik devori himoyalarini ulashdi.
Debian xavfsizlik kuzatuvchisiga ko'ra, zaiflik Debian 12 (Bookworm) uchun yadro paketi 6.1.190-1 versiyasida va Debian 13 (Trixie) uchun 6.12.113-1 versiyasida tuzatildi. Tuzatilgan paketlar Debian sinov va beqaror versiyalari uchun ham mavjud.
Boshqa Linux sotuvchilari, jumladan Oracle Linux, Amazon Linux va SUSE, ba'zi ta'sirlangan yadro versiyalari uchun tuzatishlarni ham chiqarishdi.
Zaiflik macOS ga ta'sir qilmaydi, chunki u Linux yadrosi emas, balki Apple XNU yadrosidan foydalanadi.
Administratorlarga o'z tarqatishlarining xavfsizlik maslahatlarini tekshirish va yangilangan yadro paketlari mavjud bo'lishi bilan ularni o'rnatish tavsiya etiladi.
Yamoqlar hali mavjud bo'lmagan tizimlar uchun, kirishni ishonchli tarmoqlar yoki IP manzillar bilan cheklash xavfni kamaytirishi mumkin.
CIQ shuningdek, zaif TCP qayta ishlash kodiga yetib borishdan oldin IP opsiyalarini o'z ichiga olgan IPv4 TCP paketlarini vaqtinchalik bloklashni tavsiya qiladi va bu turdagi trafikni bloklash mumkin bo'lgan nftables qoidalari misollarini ulashdi.
Kompaniya faqat MPTCP ni o'chirish yetarli emasligini ogohlantiradi, chunki asosiy zaiflik hali ham oddiy TCP trafik orqali ishga tushirilishi mumkin.
Hozirda CVE-2026-98432 ning yovvoyi tabiatda ishlatilayotgani haqida tasdiqlangan hisobotlar yo'q.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaani o'lchaydi.
Hisobotni oling
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners.
The flaw, tracked as CVE-2026-98432, also affects ordinary TCP connections, although remote code execution has not been publicly demonstrated on servers without an MPTCP listener.
Multipath TCP (MPTCP) is a TCP feature that lets a single connection use multiple network paths at the same time to improve performance and reliability. It is commonly used in environments where devices have multiple network connections, such as Wi-Fi and cellular networks.
CVE-2026-98432 is a use-after-free vulnerability in the kernel's IPv4 TCP networking code that received a severity score of 9.8 out of 10 from the Linux kernel CVE team.
The vulnerability affects Linux kernels dating back to version 4.4, including widely used distributions such as Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux.
According to the Linux kernel advisory, the vulnerability stems from a race condition in how the kernel handles TCP connection requests, potentially causing a use-after-free condition.
"tcpv4synrecvsock() transfers ownership of ireq->ireqopt to the child socket (newinet->inetopt) without copying it," reads the advisory.
"Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcpcheckreq(). tcpv4sendsynack() and inetcskroutereq() read ireq->ireqopt under rcureadlock() only, and ipbuildandsendpkt() and ipoptions_build() then read opt->optlen twice."
A similar issue can occur during TCP request socket migration when net.ipv4.tcpmigratereq is enabled, or a BPFSKREUSEPORTSELECTOR_MIGRATE program is used.
Although triggering the vulnerability requires no authentication, Red Hat says exploiting the race condition is more complex than just sending a malicious network packet.
Red Hat classifies the vulnerability as a potential denial-of-service issue that could cause a kernel crash, assigning it a lower severity score of 5.9 because exploitation is complex.
However, researchers at Anthropic demonstrated that the vulnerability could be exploited for remote code execution under specific conditions.
An Anthropic report explained that an unreleased Claude AI model developed an exploit that bypassed kernel address space layout randomization (KASLR) and executed arbitrary commands as root on a Linux server running an MPTCP listener.
According to Anthropic, the exploit took about 53 minutes to achieve remote root code execution, showing the vulnerability could be exploited for more than denial-of-service attacks.
While MPTCP is not typically enabled by default in applications, some software enables it automatically.
Beginning in Go 1.24, the programming language enables MPTCP by default for TCP listeners on Linux as long as the kernel supports the feature. Due to this, some Go-based network services may enable MPTCP listeners without administrators knowing.
Linux distros begin releasing patches
The vulnerability was fixed in the upstream Linux kernel and backported to maintained kernel branches. However, security updates have not yet been pushed out to all affected Linux distributions.
According to Canonical's security tracker, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 remain vulnerable, with kernel fixes in progress as of October 30.
Red Hat also lists RHEL 8, 9, and 10 as affected, with fixes planned for future updates. RHEL 7 is not affected because its kernel does not contain the vulnerable code.
In mitigation guidance, Rocky Linux support provider CIQ confirms Rocky Linux 8, 9, and 10 are also affected and shared temporary firewall protections for affected systems.
According to Debian's security tracker, the vulnerability was fixed in kernel package version 6.1.190-1 for Debian 12 (Bookworm) and 6.12.113-1 for Debian 13 (Trixie). Fixed packages are also available for Debian testing and unstable.
Other Linux vendors, including Oracle Linux, Amazon Linux, and SUSE, have also released fixes for some affected kernel versions.
The vulnerability does not affect macOS, which uses Apple's XNU kernel rather than the Linux kernel.
Administrators are advised to check their distribution's security advisories and install updated kernel packages as they become available.
For systems where patches are not yet available, restricting access to trusted networks or IP addresses can reduce the risk.
CIQ also recommends temporarily blocking IPv4 TCP packets containing IP options before they reach the vulnerable TCP processing code, and shared examples of nftables rules that can block this type of traffic.
The company cautions that disabling MPTCP alone is insufficient because the underlying vulnerability can still be triggered through ordinary TCP traffic.
There are currently no confirmed reports of CVE-2026-98432 being exploited in the wild.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
