Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Attackers are already exploiting a critical flaw in Linux kernel (CVE-2026-98432) -- this isn't a theoretical advisory, it's an active attack technique right now.
Attackers are already exploiting a critical flaw in Linux kernel (CVE-2026-98432) -- this isn't a theoretical advisory, it's an active attack technique right now.
The affected service is reachable from the network without authentication.
Linux kernel may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.
Active exploitation changes the calculus entirely: this has moved from theoretical risk to a live attack technique.
Anyone running Linux kernel 4.4 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
Being reachable without authentication is what moves this from 'patch eventually' to 'patch now' -- there's no login screen standing between an attacker and the vulnerable code.
This is tracked as CVE-2026-98432 and rated critical severity, which is the identifier to use when checking vendor guidance.
The affected versions are 4.4, so that's the range to check against your own deployment.
Confirm whether Linux kernel 4.4 is present anywhere in your asset and software inventory.
Treat exposed matches as urgent -- exploitation has already been reported.
What happened
Attackers are actively exploiting a critical flaw in the Linux kernel (CVE-2026-98432); this is not a theoretical advisory but an ongoing attack technique.
The affected service is accessible from the network without authentication.
The Linux kernel may be functioning normally in your environment while also being reachable from a network that an attacker can access.
What changed
The active exploitation shifts the situation significantly: this has transitioned from a theoretical risk to a live attack method.
Who is affected
Anyone running Linux kernel 4.4 is at risk, and because this vulnerability is reachable without authentication, exposure does not rely on user actions.
Why it matters
Successful exploitation grants the attacker the ability to execute code with the permissions of the affected process.
The lack of authentication is what elevates this from 'patch eventually' to 'patch now' -- there is no login screen obstructing an attacker from accessing the vulnerable code.
Technical details
This vulnerability is registered as CVE-2026-98432 and classified with critical severity, which is essential for consulting vendor guidance.
The affected version is 4.4, so that is the range to verify against your own deployment.
What security teams should do
Verify whether Linux kernel 4.4 is present in your asset and software inventory.
Treat any exposed instances as urgent, as exploitation has already been reported.