Linux MPTCP vulnerability and security chatter
A widely shared warning says unpatched Linux servers with an exposed TCP port and MPTCP active are vulnerable to complete takeover.
What we know
Noah Smith RTs a post calling it a major vulnerability, noting that MPTCP is on by default for many Go web servers.
How the story developed
A widely shared warning says unpatched Linux servers with an exposed TCP port and MPTCP active are vulnerable to complete takeover.
A flaw reportedly allows complete takeover of unpatched Linux servers with any exposed TCP port and MPTCP active, which is the default for many Go web servers.
An unauthenticated remote root exploit via MPTCP affects Linux; Ubuntu and RHEL lack fixes while others have patched some versions.
A critical Linux kernel flaw allows unauthenticated root takeover via a crafted TCP packet; Anthropic demonstrated the exploit. Ubuntu and RHEL remain unpatched.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.