Linux Flaw Requires MPTCP Listening, 慢雾 CISO 23pds Says

慢雾 CISO 23pds said claims that CVE-2026-98432 gives every Ubuntu system a zero-click path to root overstate the Linux flaw. Exploitation requires a server configured to listen for Multipath TCP (MPTCP), a feature Linux does not enable by default. The vulnerability is a use-after-free race during an IPv4 TCP handshake in Linux’s network stack, not in a specific application, 23pds said. The assessment does not establish what level of access exploitation could achieve on a server configured to listen for MPTCP. As of Oct. 30, Debian 12 and 13 had released fixes.

Source: TokenPost