A Linux TCP bug rated 9.8 has a fix since October, yet Ubuntu and RHEL still ship it

One missing copy, two kfree() calls, and a handshake that frees memory too early

The write-up from Atlasum traces the flaw to how a server handles IP options. When it accepts an IPv4 TCP connection, the kernel keeps the options the peer sent so it can echo them in replies. It handed those saved options to the new connection without copying them, then freed them when the connection closed, while another CPU could still be reading them to build a handshake reply. Eric Dumazet's fix changes two kfree() calls to kfree_rcu(), so memory is released only after readers finish.

The CNA scores it CVSS 3.1 9.8. Every kernel from 4.4 up is affected until the fixed releases (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3). Anthropic, which reported the bug, says Claude produced a working exploit that runs commands as root on servers with an MPTCP (multipath TCP) listener. A failed race only fails the handshake, so an attacker can simply retry. The exploit is unpublished, but by October 31 at least six GitHub repositories referenced the CVE with race triggers or proofs of concept.

The patch is three weeks old and the big distributions still lag

The fix was posted October 1 and shipped in stable kernels between October 11 and 18. Debian, SUSE, Oracle UEK and both Amazon Linux versions have fixed kernels. AlmaLinux has them in testing. Ubuntu lists every release as vulnerable, and RHEL 8, 9 and 10 are unfixed, although Red Hat raised its rating to Critical on October 30 and published a mitigation.

Is anyone actually running an MPTCP listener?

Go programs open MPTCP listeners by default since Go 1.24, depending on the go line in go.mod. That is the part that worried the author. Sysadmins were less sure.

"I don't know of any Linux boxes running a multipath TCP listener in my care and I have quite a few. MP generally implies a router of some sort and the intersections in a Venn diagram continue to get smaller" — a sysadmin managing many Linux hosts

Cloud users got a different kind of relief. A commenter quoted AWS's bulletin saying WAF, Application and Classic Load Balancers, CloudFront and API Gateway don't pass untrusted TCP connections to customer instances directly, though AWS still advises updating self-managed instances within 30 days.

A firewall rule that someone has run for two days

With no kernel update available, a user who runs it on several servers and a home router posted a ufw rule that drops TCP packets whose IP header length field is above 5, meaning any IP options at all. Unlike the exploit's SYN-only trigger, it drops every such packet, because any TCP packet could in theory reach the bug. He says the match counter on busy VPS servers never moved except when he triggered it by hand, and nothing broke on his servers, desktops or hardware router.

The long tail is routers and cameras

"Any smart device in the world that isn't a server, desktop, or microcontroller, is probably running Linux." — a commenter arguing for a legal support floor for connected devices

He proposes a rule that any device on the public internet must come with at least ten years of guaranteed security updates. For the devices that will never get this patch, the only available defence is dropping optioned packets at the network edge.