Remote code execution on Linux systems with multipath TCP
On October 27, LLM provider Anthropic reported on a remotely exploitable use-after-free bug affecting systems with multipath TCP listeners open.
Why am I seeing this Single-sourced — only LWN has this
Only LWN has this. It is here on that single source, so read it as one outlet's reporting until somebody else confirms it.
Single-sourced. No second organisation has confirmed it yet.
Link-outLink-out, because only one organisation carries it and no first-party source is on it. Link-out means we point at the publisher and say nothing of our own.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroborationleads | 0.35 | 0.39 | +0.135 37% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trust | 0.25 | 0.49 | +0.124 34% | LWN is the highest-trust source on this story. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.55 | +0.110 30% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
1stpangu · CC BY-SA 4.0 · Wikimedia Commons · illustrativeWhat happened
On October 27, LLM provider Anthropic reported on a remotely exploitable use-after-free bug affecting systems with multipath TCP listeners open. The bug works by triggering a response to a retransmitted SYN packet at the same moment that the TCP connection is established in another thread, causing the first thread to access the connection's options structure after the second thread has freed it. The first thread can then disclose kernel memory or cause a buffer overflow, writing an attacker-controlled payload. The fix was to only free the structure after an RCU grace period. On October 29, the Go security team advised that all programs written in Go use multipath TCP by default, so many systems may be unknowingly vulnerable.
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Lwn first seen Remote code execution on Linux systems with multipath TCP
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.