What Happened
A critical EnterProtect Linux kernel vulnerability, tracked as CVE-2026-98432, can let an unauthenticated remote attacker execute commands as root on Linux servers running Multipath TCP (MPTCP) listeners. Anthropic researchers have developed an exploit for the flaw, and AWS says updated kernel packages are available for Amazon Linux 2 and Amazon Linux 2023. For an MSP, this is an urgent patching event across every affected client environment.
The flaw sits in the Linux kernel's IPv4 TCP handshake path. BleepingComputer reports that the exploit allows an attacker with no credentials to run commands as root on servers with MPTCP listeners.
Why the EnterProtect Linux Kernel Vulnerability Costs MSPs
A remote root exploit is the worst case for a client server. It needs no credentials and no user interaction, and it gives full control over the machine. From there, an attacker can read data, deploy ransomware or move laterally to other systems.
MSPs carry the operational burden. A vulnerable Linux instance in a client fleet is not just a security ticket. It becomes a recovery job, a client notification and a test of your backup and response process.
The fix is known and the update path is clear for Amazon Linux. The hard part is coverage: knowing which client systems run affected kernels and which ones expose MPTCP listeners.
Timeline
- October 27, 2026: Anthropic said its AI model wrote an exploit that uses the flaw, according to The Hacker News.
- October 29, 2026: The Hacker News published its report on the Linux kernel TCP flaw with a 9.8 CVSS score.
- October 30, 2026: BleepingComputer published its report on remote root attacks against MPTCP servers.
- October 30, 2026: AWS published security bulletin 2026-160-AWS, with updated kernel packages for Amazon Linux 2 and Amazon Linux 2023.
Who Is Affected
Any Linux server running kernel version 4.4 or later is in scope for CVE-2026-98432, according to AWS. The distributions named by the sources are Ubuntu, Red Hat Enterprise Linux (RHEL), other Linux distributions, Amazon Linux 2 and Amazon Linux 2023.
The attack is against servers running MPTCP listeners. Multipath TCP lets one TCP connection use multiple network paths, and a listener is the service that accepts incoming connections. Not every Linux server is exposed, but any server with an MPTCP listener should be treated as exposed.
For MSPs, the affected population includes self-managed Amazon Linux instances, especially any that run MPTCP listeners. AWS says managed services are being updated automatically and require no customer action.
Technical Details
CVE-2026-98432 is a memory issue in the Linux kernel IPv4 TCP handshake path, according to AWS. The AWS bulletin title describes it as a use-after-free issue. It affects Linux kernel versions 4.4 and later.
The flaw is in the Linux kernel's TCP code and affects Ubuntu, Red Hat Enterprise Linux (RHEL), other Linux distributions, Amazon Linux 2 and Amazon Linux 2023, according to the sources.
The attack vector is remote and unauthenticated. BleepingComputer reports that Anthropic researchers developed an exploit that lets unauthenticated attackers remotely execute commands as root on servers running MPTCP listeners. The kernel's own CVE team rates CVE-2026-98432 9.8 out of 10 on the CVSS scale, according to The Hacker News.
What MSPs Should Do
Patch priority is high. An exploit exists, it is remote and unauthenticated, and it results in root access. Treat affected systems as urgent.
- Update kernel packages on Amazon Linux 2 and Amazon Linux 2023 and reboot self-managed Linux instances, as AWS recommends.
- Apply the same urgency to Ubuntu, RHEL and other distributions. Check each vendor's security channel for a kernel update for CVE-2026-98432.
- Inventory every client Linux server by distribution, kernel version and whether it runs an MPTCP listener. You cannot patch what you have not found.
- If a kernel update cannot be applied immediately, restrict network access to MPTCP listeners and review firewall rules to reduce exposure.
- After any kernel update, reboot the server so the new kernel is loaded. A running kernel stays vulnerable until reboot.
- Verify backups and recovery runbooks for every affected client. If the worst case happens, your job is to get the client running again from clean data.
How EnterProtect Helps
EnterProtect backup keeps clean, restorable copies of client systems, so you can bring an environment back from a known-good point instead of trusting a compromised one.
EnterProtect recovery gets a client running again after an outage, which is what matters most when a server is down.
EnterProtect vulnerability scanning gives you a standing view of exposed versions across the environments you manage, so you can prioritize patching before an attacker acts.
Frequently Asked Questions
What Is CVE-2026-98432?
CVE-2026-98432 is a critical Linux kernel vulnerability in the IPv4 TCP handshake path. AWS describes it as a memory issue, and its bulletin title calls it a use-after-free issue. It affects kernel versions 4.4 and later and can result in remote code execution.
Which Linux Systems Are Affected?
The sources name Ubuntu, Red Hat Enterprise Linux (RHEL), other Linux distributions, Amazon Linux 2 and Amazon Linux 2023. The underlying condition is Linux kernel version 4.4 or later. The attack targets servers running MPTCP listeners.
Has CVE-2026-98432 Been Exploited in the Wild?
Sources do not report active exploitation. However, Anthropic researchers have developed an exploit, so the risk is concrete. Treat patching as urgent.
What Should an MSP Do First?
Update kernel packages on Amazon Linux 2 and Amazon Linux 2023 and reboot self-managed instances, as AWS recommends. Then inventory all client Linux servers by distribution, kernel version and MPTCP listener status. Apply vendor updates for Ubuntu, RHEL and other distributions as they become available.
Why Is a Reboot Required After a Kernel Update?
A kernel update replaces files on disk, but the running system still uses the old kernel until it is restarted. Until the reboot, the server remains vulnerable to CVE-2026-98432. Reboots are a required part of the patching process for kernel flaws.
How Can I Reduce Risk If a Server Cannot Be Patched Immediately?
Restrict network access to MPTCP listeners and review firewall rules to reduce exposure. Monitor vendor security bulletins for CVE-2026-98432. Make sure backups and recovery runbooks are current so you can restore a client environment if it is compromised.
Sources
- Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions (Hackernews)
- Linux kernel exploit enables remote root attacks on MPTCP servers (Bleepingcomputer)
- Critical Linux kernel flaw allows remote root attacks on MPTCP servers (Bleepingcomputer)
- CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue (Aws Bulletins)