After the discovery of CVE-2026-98432 halfway last month, most people are still waiting for their distro to update to a patched kernel.
Distros like Ubuntu are working on it but the update is not there yet.
In the meantime you can check if the vulnerability affects you. If it does, you can mitigate the vulnerability yourself using the information on the site below:
P.S. many thanks to @hydn for @system (the system bot) that attended me on this vulnerability
I asked Google on how to check my system to see if I am exposed.
1. List Active MPTCP Connections and Processes
Run the following command as
rootor withsudoto see active MPTCP sockets, their associated PIDs, process names, and subflow counts:sudo ss -Mani -p
On my system, that reported no instances of active MPTCP involvement.
3. Check Kernel MIB Counters for MPTCP Activity
If you want a global statistical summary of whether MPTCP traffic has been processed by the kernel, use
nstat.sudo nstat -asz | grep MPTcpExt
For me, that report came back as follows:
MPTcpExtMPCapableSYNRX 0 0.0
MPTcpExtMPCapableSYNTX 0 0.0
MPTcpExtMPCapableSYNACKRX 0 0.0
MPTcpExtMPCapableACKRX 0 0.0
MPTcpExtMPCapableFallbackACK 0 0.0
MPTcpExtMPCapableFallbackSYNACK 0 0.0
MPTcpExtMPFallbackTokenInit 0 0.0
MPTcpExtMPTCPRetrans 0 0.0
MPTcpExtMPJoinNoTokenFound 0 0.0
MPTcpExtMPJoinSynRx 0 0.0
MPTcpExtMPJoinSynAckRx 0 0.0
MPTcpExtMPJoinSynAckHMacFailure 0 0.0
MPTcpExtMPJoinAckRx 0 0.0
MPTcpExtMPJoinAckHMacFailure 0 0.0
MPTcpExtDSSNotMatching 0 0.0
MPTcpExtInfiniteMapTx 0 0.0
MPTcpExtInfiniteMapRx 0 0.0
MPTcpExtDSSNoMatchTCP 0 0.0
MPTcpExtDataCsumErr 0 0.0
MPTcpExtOFOQueueTail 0 0.0
MPTcpExtOFOQueue 0 0.0
MPTcpExtOFOMerge 0 0.0
MPTcpExtNoDSSInWindow 0 0.0
MPTcpExtDuplicateData 0 0.0
MPTcpExtAddAddr 0 0.0
MPTcpExtAddAddrTx 0 0.0
MPTcpExtAddAddrTxDrop 0 0.0
MPTcpExtEchoAdd 0 0.0
MPTcpExtEchoAddTx 0 0.0
MPTcpExtEchoAddTxDrop 0 0.0
MPTcpExtPortAdd 0 0.0
MPTcpExtAddAddrDrop 0 0.0
MPTcpExtMPJoinPortSynRx 0 0.0
MPTcpExtMPJoinPortSynAckRx 0 0.0
MPTcpExtMPJoinPortAckRx 0 0.0
MPTcpExtMismatchPortSynRx 0 0.0
MPTcpExtMismatchPortAckRx 0 0.0
MPTcpExtRmAddr 0 0.0
MPTcpExtRmAddrDrop 0 0.0
MPTcpExtRmAddrTx 0 0.0
MPTcpExtRmAddrTxDrop 0 0.0
MPTcpExtRmSubflow 0 0.0
MPTcpExtMPPrioTx 0 0.0
MPTcpExtMPPrioRx 0 0.0
MPTcpExtMPFailTx 0 0.0
MPTcpExtMPFailRx 0 0.0
MPTcpExtMPFastcloseTx 0 0.0
MPTcpExtMPFastcloseRx 0 0.0
MPTcpExtMPRstTx 0 0.0
MPTcpExtMPRstRx 0 0.0
MPTcpExtRcvPruned 0 0.0
MPTcpExtSubflowStale 0 0.0
MPTcpExtSubflowRecover 0 0.0
MPTcpExtSndWndShared 0 0.0
MPTcpExtRcvWndShared 0 0.0
MPTcpExtRcvWndConflictUpdate 0 0.0
MPTcpExtRcvWndConflict 0 0.0
MPTcpExtMPCurrEstab 0 0.0
Which reports no instances of MPTCP being used, meaning no exposure from my normal usage.
I will do a sanity check and re-run at the end of my login session to be on the safe side and re-confirm that there was no usage/exposure.
When I asked which systems would break if I set net.mptcp.enabled to zero, the response was as follows:
Disabling MPTCP (
net.mptcp.enabled = 0) will not break any critical Linux operating system processes, as standard TCP (TCP) remains fully active as the fallback.MultiPath TCP (MPTCP) is an extension to standard TCP that allows a device to use multiple network interfaces (like Wi-Fi and cellular) simultaneously for a single connection. When you disable it, applications that explicitly request MPTCP will automatically and transparently fall back to standard single-path TCP.
This is exactly what I have done.
If you don’t need any wacko apps, like for instance WhatsApp, you’re good.
(WhatsApp can’t function without MPTCP or so it seems)
It also shields you when running Golang apps which have MPTCP enabled by default.
If people haven’t noticed this yet, the following was posted by Ubuntu on that issue more than 8 hours ago
https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432
Depending on your release, the update was available first thing this morning, or was available in proposed and thus could be pulled in early if you didn’t want to wait as per normal SRU [Stable Release Update] requirements.
Jammy (22.04) linux Fix available in -proposed (5.15.0-203.213)
Noble (24.04) linux Fix available in -proposed (6.8.0-149.149)
Resolute (26.04) linux Fix available in -proposed (7.0.0-43.43)
Stonking (26.10) linux Fixed in 7.3.0-10.10