Anthropic Researchers Reveal Exploit Targeting Linux Kernel’s MPTCP Feature, Granting Remote Root Access

Security researchers from the AI‑focused firm Anthropic have disclosed a functional exploit for a high‑severity vulnerability in the Linux kernel that can give unauthenticated attackers full control over servers running Multipath TCP (MPTCP) listeners. The flaw, classified as critical, enables remote code execution with root privileges, allowing malicious actors to issue commands on affected systems without any prior access.

The vulnerability resides in the kernel’s handling of MPTCP, a protocol extension that permits a single TCP connection to use multiple network paths simultaneously. While MPTCP is valued for its resilience and bandwidth aggregation—features used by data‑center services, mobile devices, and some enterprise applications—the flaw compromises the very mechanism that manages these parallel streams. By crafting specially designed packets, an attacker can trigger a condition that bypasses normal privilege checks, leading to a root‑level shell on the target host.

Anthropic’s team built a proof‑of‑concept exploit to demonstrate the risk, confirming that the attack can be launched from the Internet without any authentication or user interaction. The researchers shared their findings with the Linux kernel maintainers, who have since issued an advisory and are preparing a patch. In the meantime, they recommend administrators disable MPTCP listeners or apply interim mitigations such as kernel parameter hardening and firewall rules that block unexpected MPTCP traffic.

The discovery follows a series of recent kernel‑level exploits that have highlighted the challenges of maintaining security in a complex, open‑source codebase. Linux powers a majority of web servers, cloud infrastructure, and embedded devices; any vulnerability that grants root access can have far‑reaching consequences. Experts note that MPTCP, while not enabled by default on most distributions, is increasingly adopted in high‑availability environments, making the exposure noteworthy for organizations that have explicitly enabled the feature.

Industry response has been swift. Major Linux distribution vendors, including Red Hat, Ubuntu, and SUSE, have begun testing the upcoming fix and are expected to roll out updates within the next few days. Security advisories from these vendors will likely reference the same CVE identifier assigned to the flaw, enabling automated patch management tools to flag vulnerable systems.

As the patch dissemination progresses, analysts advise network operators to inventory their deployments for active MPTCP listeners and prioritize remediation. The incident underscores the importance of timely kernel updates and the need for continuous monitoring of emerging threats, especially for services that rely on advanced networking extensions. The full details of the exploit were originally reported by BleepingComputer, which highlighted the urgency of applying the forthcoming security fix.