{
  "id": 17248738,
  "title": "Remote code execution on Linux systems with multipath TCP",
  "url": "https://urgent.news/2026/10/30/remote-code-execution-on-linux-systems-with-multipath-tcp",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-30T15:45:27.000Z",
  "source": {
    "name": "LWN",
    "slug": "lwn",
    "url": "https://lwn.net/Articles/1104192/"
  },
  "original_language": "en",
  "account": "On October 27, Anthropic disclosed a remotely exploitable use-after-free bug in Linux systems that have multipath TCP listeners enabled. The vulnerability arises when a response to a retransmitted SYN packet is received simultaneously as the TCP connection is being established in another thread. This leads to the first thread accessing the connection's options structure after it has been freed by the second thread. As a result, the first thread can expose kernel memory or cause a buffer overflow, writing an attacker-controlled payload.\n\nThe issue is resolved by ensuring the structure is only freed after an RCU grace period. On October 29, the Go security team recommended that all Go programs utilize multipath TCP by default, potentially leaving many systems unknowingly vulnerable. There is also the possibility of related bugs in other areas of the TCP stack.\n\nUsers are advised to update to a patched kernel as soon as one is available for their distribution.",
  "summary": "On October 27, LLM provider Anthropic reported on a remotely exploitable use-after-free bug affecting systems with multipath TCP listeners open. The bug works by triggering a response to a retransmitted SYN packet at the same moment that the TCP connection is established in another thread, causing the first thread to access the connection's options structure after the second thread has freed it.…",
  "key_points": [
    "Remote code execution vulnerability in Linux systems with multipath TCP discovered on October 27.",
    "Go security team recommends default use of multipath TCP, potentially leaving systems vulnerable."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}