Technology
Critical Linux TCP flaw leaves major distributions awaiting fixes
A Linux kernel use-after-free in IPv4 TCP handshakes has received a critical CVSS 9.8 rating, and affected systems may be reachable remotely before application authentication. Fixed upstream kernels exist, but Ubuntu and RHEL still listed affected releases as vulnerable on October 31. The report attributes a working root-command exploit on systems with multipath TCP listeners to Anthropic, while noting that the exploit has not been published or independently tested. Administrators should track distribution fixes, reboot after patching and treat mitigations as temporary.
Editorial summary · Publisher article
What matters
- The flaw affects unpatched Linux kernels from 4.4 onward and can expose hosts accepting IPv4 TCP connections.
- Debian, SUSE, Oracle Linux and Amazon Linux had fixes available; Ubuntu and RHEL had not released fixes at the reported time.
- The upstream fix delays memory reclamation using RCU.
- Firewall rules and disabling multipath TCP can reduce exposure but do not repair the kernel vulnerability.
Exposure and exploitation status
The vulnerable path runs during TCP handshake processing, before application authentication. Anthropic says its model produced an exploit for servers with multipath TCP listeners, but the exploit has not been published and the report’s authors did not test public proof-of-concept code. The CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the stated update time.
Mitigation limits
Dropping IPv4 TCP packets carrying IP options can reduce exposure, but the report says the rule does not fix the kernel, lasts only until reboot and may miss traffic bridged between containers. Disabling multipath TCP removes the setup described in Anthropic’s exploit, not the underlying bug.
Context & caveats
- Distribution kernel versions and fix availability can change; the report’s status was recorded on October 31.
- The reported exploit claims are attributed to Anthropic and were not independently reproduced in the supplied material.
Why this made the edition
The report provides extensive technical detail, distribution-by-distribution status, attributed exploitation claims, testing, mitigations and explicit limits. It is highly relevant to operators of Linux infrastructure, though some exploitation details remain unverified.
Source material