On 27 October 2026, Anthropic published a report saying its unreleased internal research model wrote an exploit for the Linux kernel flaw CVE-2026-98432. According to the report, an attacker on the internet only needs to send packets to a Linux server with a Multipath TCP (MPTCP) listener, with no login at all, and can then run commands as root. As of 30 October, Ubuntu's security tracker still marked the kernels for Ubuntu 22.04, 24.04, 26.04, and 26.10 as vulnerable, with a fix "work in progress".

So there is a gap: the flaw is public, an exploit has been claimed, and Ubuntu's fixed kernel is not out. If your business's servers are run by a vendor or agency, that gap is still your problem, because your data and your service take the hit. Our view is simple: do not wait for proof of real attacks before you start checking. Below is what is established, what is still a claim, and what you can check today.

What is established, and what is still a claim

From the official CVE record: this is a use-after-free bug in the Linux kernel's IPv4 TCP code, present since kernel 4.4, and scored 9.8 (critical) by the Linux kernel CVE team. Ubuntu uses the same score and lists the priority as High.

Picture two clerks at one counter. One throws away a guest's note while the other is still reading it. With the right timing, the second clerk reads garbage. In the kernel, an attacker who controls that timing can make the kernel use data that no longer belongs to it. All it takes is completing a TCP handshake with an open port. The IPv6 side is not affected by the main bug.

What remains a claim is the remote root exploit itself. That is Anthropic's own report, and the code is not published. In their test it took 48 minutes to leak one kernel memory address, then five more minutes to reach command execution. The target was a server with an MPTCP listener. Yet the CVE record never mentions MPTCP, and the Go security team wrote that the bug is not specific to MPTCP, so servers without it could face similar attacks. No real-world attacks have been reported, and as of the 29 October revision the flaw was not in CISA's KEV catalogue, according to Business Upturn.

Two cards: what is established from the CVE record (use-after-free bug, score 9.8) and what is still a claim (Anthropic exploit, the role of MPTCP, no real attacks yet)

Who has fixed it, and who has not

The kernel fix is already in the upstream stable branches: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, and 7.2.10. Debian has shipped a fixed kernel for bookworm (6.1.190-1) and trixie (6.12.113-1). Oracle Linux released an update on 16 October, according to Cyber Kendra.

Ubuntu has not. The table on Ubuntu's page, last updated 30 October, lists 22.04, 24.04, 26.04, and 26.10 as vulnerable with a fix in progress. Ubuntu 16.04, 18.04, and 20.04 are vulnerable with no fix listed. Ubuntu 14.04 is not affected. Red Hat also states that no mitigation meets its standards so far.

This is not about who is slower, since every distribution tests its own kernel before release. But for a business owner the outcome is the same: as of 30 October, an Ubuntu server has no official fixed kernel to install. Check the page again today, because the status can change at any time.

Timeline for October 2026: CVE published 15 October, Oracle Linux update 16 October, Anthropic reports exploit 27 October, Go team warning 29 October, Ubuntu still without a fixed kernel 30 October

While you wait: shrink the open doors

The fixed kernel remains the real answer. Once Ubuntu releases it, install it and reboot, because a new kernel only takes effect after the server restarts. Until then, three things make sense:

  • Limit who can reach the server. The attack needs a TCP connection to an open port. Do not leave unneeded ports open to the public. Admin pages, SSH, and databases should be reachable only from known IP addresses or through a VPN.
  • Check whether MPTCP is enabled. On the oss-security list, someone suggested the command `sysctl -w net.mptcp.enabled=0` to switch it off server-wide, noting that programs that genuinely need MPTCP may break. The Go team calls disabling MPTCP per program a fragile mitigation: one forgotten listener leaves the server exposed, and the approach assumes every viable exploit depends on MPTCP, which is unproven. Treat it as an extra fence, not a replacement for the new kernel, and leave the change to someone who understands the impact.
  • Watch the Ubuntu page daily until the status changes.
Five checks: Ubuntu release and running kernel, open ports, MPTCP status, schedule for the fixed kernel, re-check every day

What you can ask your vendor for

You do not need to understand the kernel to ask for answers. Send one message to your vendor, agency, or hosting provider, and ask for dated written replies. These are questions they can answer within one working day:

Seven questions for the vendor: Ubuntu release, running kernel, open ports, MPTCP status, new kernel schedule, tested backup, and an out-of-hours contact

An answer like "we are monitoring it" with no date is not an answer. A healthy vendor will give you the kernel version, the list of ports, and when the reboot is scheduled.

Our position

The habit of "wait for real attacks, then act" is wrong for a flaw like this. The score is 9.8, it is reachable from the network without a login, and a claim of a working exploit has been published by a party that can be traced. That is enough to start checking today. If the server turns out to be fine, you have lost one WhatsApp message and a few hours of your vendor's time. If it is not, the difference is days without a fence.

If you are not sure which side your server is on, contact us on WhatsApp at +62 823 1499 5005 for a security check consultation. We will help you read your vendor's answers and draft a list of what to fix first. More information is at xetup.id.

Sources