Anthropic says the remote root path for CVE-2026-98432 needs a multipath TCP listener. Until Ubuntu and RHEL ship kernels, here’s how I check my own boxes.
1. See what kernel you’re on
uname -rCompare it with your distro’s security tracker for the CVE.
2. Is MPTCP even on?
sysctl net.mptcp.enabled3. List MPTCP listeners
sudo ss -M -ltnp-M shows MPTCP sockets only. An empty list means nothing’s asking for MPTCP. Apps have to opt in, so most servers will show nothing.
4. Stopgap if you don’t use it
sudo sysctl -w net.mptcp.enabled=0That stops new MPTCP sockets from being created. To make it stick, put it in a file under /etc/sysctl.d/. I push changes like this through Ansible so every host matches. It’s not a fix. The race is in the TCP code itself, so patch and reboot as soon as the kernel lands.
Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.
God Bless, and Happy hacking!
