Multipath TCP on Linux: vulnerability CVE-2026-98432 and usage detection

What happened and what to do

The SANS ISC post covers Multipath TCP, a TCP option introduced in 2020 and described in RFC 8684, which is often overlooked in inventories and network monitoring. The week before publication, a new vulnerability in the Linux implementation, identified as CVE-2026-98432, put the option at the center of attention, and the text addresses its use and ways to detect it.

For a company with Linux servers or workstations, the practical response starts with an inventory: identify hosts with MPTCP enabled, compare the kernel version against the vendor advisory, and apply the available fix. Then it is worth monitoring traffic with sensors that record TCP options, creating detection rules in an IDS or firewall, and centralizing these signals in a dashboard. This need is about collecting, correlating and operating network data, and does not require AI; if event volume is large, local models could only help with triage.

How the consultancy can help

Diagnosis of exposure to Multipath TCP on Linux servers and workstations, including host inventory, version checks and fix prioritization. Implementation of TCP option collection and monitoring, with alerts and a dashboard, operated in the client's environment.

Next step

Send a short description of your Linux environment and network and receive a scoped proposal for diagnosis and implementation.