Marcus Hutchins reported suspected MPTCP probing on November 2, according to Aikido’s account of CVE-2026-98432. For Linux operators, the practical response is to install the vendor-fixed kernel, reboot, and check the version actually running.
Aikido attributes to Hutchins an October 30 scan that found about 2.1 million servers reachable over MPTCP on port 443. The figure describes MPTCP reachability, not a count of successful attacks.
How the MPTCP demonstration relates to the flaw
CVE-2026-98432 is a use-after-free in IPv4 TCP connection setup, a kernel bug in which code can refer to memory after it has been freed. Aikido says the flaw dates to Linux 4.4 and that the exploit demonstration attributed to Anthropic used an MPTCP listener. Aikido also says Red Hat’s position is that MPTCP is not required for the underlying flaw.
Disabling MPTCP and restarting affected listeners can reduce exposure, but it does not fix the kernel. Aikido describes the relevant exposure as an attacker-reachable IPv4 TCP listening port. NeoTeo’s earlier coverage of Red Hat’s limited mitigation and Amazon Linux packages provides more vendor-specific context.
Check the kernel that is running
Install the fixed kernel provided for your distribution, then reboot. Afterward, run uname -r and compare the result with the distribution’s fixed package version. Distributions backport fixes, so their package identifiers can differ from upstream kernel version numbers.
For containers, the relevant kernel belongs to the node running them; updating an application image does not update that host kernel. A reverse proxy on the same host also leaves that host’s kernel handling the TCP handshake. A separate load balancer that terminates TCP can reduce exposure.
A bounded claim about Debian and Ubuntu
A Linux Renaissance host claimed that Debian patched this CVE within 24 hours and that Ubuntu LTS updates lagged in regular channels.
