Linux kernel MPTCP flaw enables remote root exploit
A critical Linux kernel flaw in MPTCP listeners now has a working exploit for remote root. See how to check servers and why kernel updates matter.
TL;DR: A critical Linux kernel flaw affects servers with Multipath TCP (MPTCP) listeners, and an exploit exists that gives an unauthenticated remote attacker root.
What happened
BleepingComputer reported on October 30, 2026 that researchers at Anthropic built an exploit for the flaw. According to the report, it lets an unauthenticated attacker run commands as root on a server that has an MPTCP listener. The report is the only source we reviewed, so it gives no CVE identifier or fixed kernel version here. Look for your distribution's kernel security notice.
Am I affected?
Only servers that accept MPTCP connections are in scope. To check one machine by hand, run sysctl net.mptcp.enabled and uname -r, and ss -M to list MPTCP sockets. If MPTCP is off and nothing listens on it, exposure is lower, but plan the kernel update anyway. Kernel fixes need a reboot, so schedule one.
How to check with Stackurity
Stackurity's agent reads installed kernel packages on Debian, Ubuntu, Alpine, Rocky Linux, AlmaLinux, Red Hat Enterprise Linux, SUSE Linux Enterprise, openSUSE Leap and Oracle Linux, and matches them against advisories. It shows the upgrade to move to, and check again confirms afterwards whether the new kernel is the one running. Live kernel patches from Ksplice are not read by Stackurity, so confirm those by hand.
Stackurity keeps a live inventory of installed packages through a read-only agent on Linux servers and matches it against new advisories every hour, using each distribution's own version rules so that backports are not reported as false alarms. After an upgrade, check again records whether the issue is really gone. Read how verification works. The core is open source, and Stackurity Cloud offers a 14-day free trial without a card: start a free trial.
