October has been a busy month for anyone in IT. Between the PHP exploits making the rounds and the turbulence with some of the major certificate providers, most admins I know haven’t had many quiet evenings lately. Now we have another one to add to the list: a vulnerability in the Linux kernel’s Multi-Path TCP (MPTCP) implementation, tracked as CVE-2026-98432.
You’re affected if you’re running a kernel older than:
- 7.2.10
- 6.18.56
- 6.12.113
Upstream patches are out. Ubuntu, though, has been a bit slower than usual getting patched kernels into its official repositories. If you look after Ubuntu systems like we do, this is one to keep an eye on.
Step 1: Check Your Kernel
Start by finding out what you’re running:
uname -rIf your version is older than the ones listed above, you’re exposed. Before you change anything, take a checkpoint or snapshot if it’s a VM. If it’s physical hardware, make sure you have a current backup. I’ve been in this business long enough to know that the one time you skip this step is the time you’ll need it.
Once you have your safety net, update:
sudo apt update && sudo apt upgrade -yThe new kernel doesn’t do anything until you reboot. Plan the reboot, then run uname -r again to confirm you’re on the patched version.
What Is MPTCP, and Why Should You Care?
MPTCP lets a single TCP connection use more than one network path at the same time. Think of a site with a fibre line and an LTE backup. MPTCP can use both together for more throughput, and if one drops, the connection carries on over the other without the user noticing. That’s great for reliability, and it’s why MPTCP is turning up by default in SD-WAN gear, Kubernetes networking, and edge computing setups.
To see whether anything on your system is using MPTCP, run:
ss -MltnThat lists any services listening on MPTCP sockets. To also catch active connections your system has opened outward, run ss -M without the extra flags. If both come back empty, nothing on that box is relying on MPTCP, and you can most likely switch it off.
Mitigating While You Wait
If your applications don’t need MPTCP, you can disable it right now while you wait on the patched kernel:
sudo sysctl -w net.mptcp.enabled=0This stops new MPTCP connections from being created. Connections that are already open stay up until they close. A service restart or a reboot clears them out.
If everything tests fine with MPTCP off, make the change survive a reboot:
sudo nano /etc/sysctl.d/99-disable-mptcp.confAdd this line, then save and exit:
net.mptcp.enabled=0Apply it without rebooting:
sudo sysctl --systemOnce you’re on a patched kernel, you can delete that file and turn MPTCP back on if you need it.
Keep an Eye On It
We’re watching this closely. Ubuntu should have patched kernels out soon, so run your updates regularly over the next few days, and don’t forget the reboot.
If you’re looking for more, check out our recent posts on fixing Hyper-V Domain Controller time sync loops and sorting out Wazuh SIEM disk space issues.
Not sure where your servers stand, or don’t have the time to check them all yourself? Get in touch with us at Aspyn. We’ll audit your kernel versions and get you patched, so you can get back to running your business. Let’s make your IT work for you, not the other way around.
