Linux Kernel Flaw Lets Attackers Take Root Remotely—What You Need to Know

Michael Miller · 2026-10-30

Security researchers at Anthropic just dropped a bombshell: they've developed an exploit for a critical Linux kernel vulnerability that lets unauthenticated attackers remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. Yeah, that's as bad as it sounds. If you're running MPTCP on your servers, you need to pay attention. ### What's MPTCP and why should you care? Multipath TCP is an extension of TCP that allows a single connection to use multiple network paths simultaneously. It's great for redundancy and performance, but it also opens up a wider attack surface. The vulnerability in question allows an attacker to send specially crafted packets to a server with MPTCP enabled and gain root access without any credentials. That means full control over the server—game over. ### How the exploit works Anthropic's researchers found a way to exploit a flaw in the kernel's handling of MPTCP options. By sending malicious packets, an attacker can trigger a use-after-free condition, leading to arbitrary code execution with kernel privileges. Since MPTCP is often enabled by default in some Linux distributions, many servers could be at risk. The exploit is remote and unauthenticated, making it extremely dangerous. > "This is a wake-up call for anyone running MPTCP in production," said one security expert. "Patch now or risk everything." ### Who's affected? If you're running a Linux server with MPTCP enabled, you're potentially vulnerable. This includes web servers, database servers, and any other service that uses MPTCP. The vulnerability affects a wide range of kernel versions, so it's crucial to check your system. Major distributions have released patches, but it's up to you to apply them. ### What you should do right now - **Check if MPTCP is enabled**: Run `sysctl net.mptcp.enabled`. If it returns 1, MPTCP is active. - **Apply the latest kernel updates**: Patches are available from your distribution's repository. Don't wait. - **Disable MPTCP if not needed**: If you don't use MPTCP, you can disable it by setting `net.mptcp.enabled=0` in your sysctl configuration. - **Monitor for suspicious activity**: Look for unusual outbound connections or privilege escalation attempts. ### The bigger picture This isn't the first kernel vulnerability, and it won't be the last. But it's a stark reminder that even seemingly benign features like MPTCP can introduce serious risks. Staying on top of patches and minimizing your attack surface is key. And if you're managing antidetect browsers or other privacy tools, remember that the underlying infrastructure must be secure too. A compromised server can undo all your efforts. So, take a few minutes today to check your systems. Update your kernel, disable unnecessary features, and keep an eye on your logs. Your future self will thank you.