CRISUSCentral Registry of Incidents, Outages and Extensive Shrugging

Crisus · · hourly updates in Dutch

TCP2Shell: a hole in Linux’s TCP code

A bug in the way the Linux kernel sets up a TCP connection: TCP2Shell. According to Anthropic, an attacker can use it to get root remotely, without logging in, on a server with MPTCP. Debian, SUSE, Oracle, Amazon, Red Hat and AlmaLinux have the fix. Since 6 November Ubuntu too, for 22.04 up to and including 26.10: in the regular updates, without an advisory. Don’t panic. Do update and reboot.

15.10.2026Since 15 October the fix has been in the kernel. Since 6 November it is in Ubuntu’s updates too, without an advisory. Every minute on this clock is a minute that a server without a reboot still runs the old kernel. Is the fix there for me?

Current crisis level: 3 of 5

  1. 0 · Business as usualEverything hums. 50 Hz. Always.
  2. 1 · CalmSomeone reads the changelog
  3. 2 · AlertThere is a Signal group
  4. 3 · SeriousStatus quo since 2001
  5. 4 · Very seriousThe manager asks if it works yet
  6. 5 · Friday afternoonSomeone says: “it’s only a small change”

For those who want a moment of calm: 50 hertz, like the power grid. Quiet, and only when you click.

What is going on?

The bug
CVE-2026-98432: a use-after-free in the kernel’s IPv4 TCP code. While setting up a connection with IP options (Record Route or Timestamp), the kernel can read memory that has just been freed, if a retransmitted SYN is handled on another CPU at the same time. It has been there since kernel 4.4, from 2016. IPv6 is not affected.
What is MPTCP?
Multipath TCP: one connection over several network paths at once, for example wifi and 4G on a phone. If one path drops, the connection carries on over the other. It is an extension of TCP (RFC 8684). Apple has used it on iPhones since 2013, among other things for Siri, and Linux has supported it since kernel 5.6 (mptcp.dev, Wikipedia). To the rest of the internet it looks like ordinary TCP. Two roads to Rome. For an attacker too.
Why is it on?
MPTCP lives in the kernel, but a program has to ask for it. Almost no program does. Except anything written in Go: since Go 1.24, from February 2025, a Go server asks the kernel for MPTCP by default, say the release notes. The programmer does not have to do anything, and usually does not know. Go itself is not vulnerable. It just opens the door to the part of the kernel that is.
What can an attacker do?
Anthropic’s Frontier Red Team wrote on 27 October that an unreleased Claude model built a working exploit with it: remote, without logging in, root on a server with an MPTCP listener (Anthropic). Leaking a kernel pointer took 48 minutes, the shell another five. The exploit has not been published. Whether it also works without MPTCP is not clear. Yes, Claude is related to the author of this page. We have not talked about it at home yet.
Severity
CVSS 9.8, from the kernel’s CVE team. Red Hat first said 8.1, “Important”: the race is hard to win. Since 30 October Red Hat says 9.8 too, “Critical”. Amazon sticks to 8.1, Feedly to 5.9. Four parties, three numbers. All four: update.
Which versions?
Everything from 4.4. The fix is in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3.
Exploited?
Not seen yet. The bug is not in CISA’s KEV catalog, and Anthropic’s exploit is not public. But someone is looking: since 2 November researcher Marcus Hutchins sees internet-wide scans that knock on port 443 with MPTCP (Mastodon, 3 November).
Why TCP2Shell?
The bug has no name of its own. After PHP2Shell and HTTP2Shell, the crisis team could not go back.

What should you do?

Stay indoors. Keep the door locked.

  1. Check whether your kernel has the fix. Debian 13 has 6.12.113-1, Debian 12 6.1.190-1. Ubuntu 22.04 has 5.15.0-203, 24.04 6.8.0-149, 26.04 7.0.0-43 and 26.10 7.3.0-10; those for 22.04 up to 26.04 are only in the regular updates, not in the security pocket, so unattended-upgrades does not fetch them by default. Update and reboot, or the old kernel keeps running: 
    uname -r
sudo apt update && sudo apt full-upgrade
sudo reboot
  2. No fix yet, or no reboot possible yet? (Ubuntu 20.04 and older.) Then keep out TCP packets with IPv4 options. Normal traffic does not use them; RFC 7126 already recommends filtering them. This rule comes from RFF: 
    sudo nft add table ip cve_2026_98432
sudo nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
sudo nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
    It is gone after a reboot unless you make it persistent. Does your network use CIPSO labels (SELinux or Smack with NetLabel)? Then don’t, those need the options.
  3. Running services in Go? Turn MPTCP off until the kernel is updated, and restart the service: 
    GODEBUG=multipathtcp=0          # Go 1.24 and later
sudo ss -lnMp                   # which processes listen with MPTCP?
  4. Do not click links in e-mails about this bug. We never send e-mail. And if we did, it would go over a single path.

Status per platform, 7 November 06:00

This is the short version. The updates, the radar and the earlier crises are on the Dutch page. The previous crisis, PHP2Shell, is closed: crisus.nl/php (in Dutch).

The war goes on

Russia has been waging war against Ukraine since 2014. That war is not over. These clocks keep running until it is.

Since the occupation of Crimea20 February 2014The date set by Ukrainian law in 2015. Russia’s own medal “For the Return of Crimea” says 20 February too.

Since the war in Donbas12 April 2014An armed unit led by the Russian Igor Girkin seizes Sloviansk.

Since MH1717 July 2014A Russian Buk missile shoots down flight MH17 from Amsterdam to Kuala Lumpur over Donbas. All 298 people on board die, 196 of them Dutch. In 2022 a Dutch court convicts three men of murder and finds that Russia was in control of the fighters in Donbas.

Since the full-scale invasion24 February 2022Just before 05:00 Kyiv time, Putin announces a “special military operation”. Within minutes, the attack begins.

Want to do something? Support Ukraine, for example through Aid to Ukraine.

Sources