Researchers Develop Exploit for Critical Remote Root Flaw in Linux Kernel MPTCP Code

What Happened

According to BleepingComputer, security researchers at Anthropic have developed a working exploit for a critical Linux kernel vulnerability affecting servers that run Multipath TCP (MPTCP) listeners. The flaw reportedly allows unauthenticated, remote attackers to execute arbitrary commands as root. At the time of this writing, specific details such as a CVE identifier, affected kernel version ranges, and the exact root-cause vulnerability class have not been confirmed in the available reporting.

Why It Matters

MPTCP is a kernel-level transport protocol extension used to combine multiple network paths (for example Wi-Fi and cellular) into a single TCP connection. It is increasingly enabled in mobile, data-center, and cloud environments. A kernel-level, pre-authentication, remote-root exploit targeting MPTCP listeners would be a severe finding. It operates below most application-layer defenses, requires no credentials, and yields the highest level of privilege on the host. Any organization running Linux systems with MPTCP enabled, whether intentionally or via a distribution default, should treat this as a high-priority item to track until more technical detail is published.

What Defenders Should Do Now

• Inventory which Linux hosts have MPTCP enabled and are listening for MPTCP connections (check for active use of the net.mptcp.enabled sysctl and related socket options).
• Where MPTCP is not required for business operations, consider disabling it as a precaution until an official patch and advisory are available.
• Watch vendor and distro security feeds (kernel.org, distro security lists, NVD) for an official CVE and patch covering this issue.
• Monitor for kernel crashes, unexpected process spawns as root, or anomalous network behavior on hosts that terminate MPTCP connections, as potential indicators of exploitation attempts.
• Ensure kernel patching and crash-reporting telemetry pipelines are in good health so a fix can be deployed quickly once released.

Developing Story

This item is based on a single news report and details are still emerging. No CVE identifier or patch has been confirmed as of this writing. We will continue to track this story and update our coverage as official advisories and technical details become available. Read the original report at BleepingComputer.