Anthropic Researchers Flag Linux MPTCP Flaw Enabling Remote Root Access

Key points

• Anthropic researchers found a Linux kernel issue in MPTCP that can allow command execution without authentication at root level.
• No CVE identifier has been assigned, which can complicate tracking and patch prioritization.
• Exposure is limited to systems acting as MPTCP servers, but those hosts may be fully compromised.
• Admins should inventory MPTCP use, disable it where unnecessary, and watch distro and kernel advisories.

Researchers at Anthropic have disclosed research into a security weakness in the Linux kernel's Multipath TCP (MPTCP) implementation. The issue can allow an attacker without credentials to execute commands remotely, and in the worst case gain root-level control. The finding applies to Linux systems configured as MPTCP servers. No CVE ID has been published.

MPTCP lets a host use multiple network paths at the same time. That can improve resilience and throughput, but it also expands the attack surface when such services are reachable by untrusted networks. Because exploitation requires no authentication, an internet-facing MPTCP server could be targeted directly. A successful attack could give the intruder the highest privileges, enabling persistence, data access, and lateral movement.

The researchers also worked on exploit development, indicating a practical attack path rather than a purely theoretical concern. The absence of a CVE means defenders cannot rely on CVE-based scanners or standard patch-tracking workflows. Although the severity hint is medium, the impact is high for any exposed MPTCP server, so risk should be judged by exposure rather than the label alone.

What to watch: upstream Linux kernel fixes, distribution advisories, and further researcher publication. Until a patch is available, reduce exposure. Verify whether MPTCP is enabled and whether any services are listening. Monitor for unusual root-level processes, unexpected outbound connections, and authentication anomalies on MPTCP-capable hosts.

What to do now

1. Inventory Linux hosts and determine which ones have MPTCP enabled or are configured as MPTCP servers; check kernel configuration, loaded modules, and listening services.
2. Disable MPTCP on systems that do not require it, and remove or restrict MPTCP-capable services from untrusted networks.
3. Block external access to MPTCP endpoints with firewall rules and network segmentation until patching or mitigation is confirmed.
4. Track upstream Linux kernel and distribution advisories closely, since no CVE identifier is available for standard vulnerability workflows.
5. Hunt for signs of exploitation on exposed MPTCP hosts, including unexpected root processes, anomalous outbound connections, and kernel or authentication log irregularities.
6. If MPTCP must remain enabled, isolate affected servers, require VPN or strong network access controls, and increase logging and monitoring.
7. Test any configuration change or workaround in a lab before applying it broadly, and document affected systems for follow-up patching.

Original source

BleepingComputer