Anthropic’s Frontier Red Team disclosed a striking research result: an unreleased Claude model produced a working exploit for a critical Linux kernel vulnerability tracked as CVE-2026-98432. According to Anthropic, the proof-of-concept lets a remote attacker run commands as root without a login or user interaction. The company treated the work as a lab test and said the underlying bug has been fixed upstream and backported to maintained kernel branches—but distribution coverage and exact attack details remain uneven.
What Anthropic reported
Anthropic’s post describes a two-step exploit chain that targets a race condition in the kernel networking stack that leads to a use-after-free. In their outline, the exploit first causes the kernel to send extra bytes back to a requester; one reply can leak a kernel pointer and thereby defeat KASLR (Kernel Address Space Layout Randomization). With the memory layout revealed, the chain then overwrites a callback pointer so the kernel executes a payload placed by the attacker, ending in a root shell command. Anthropic’s timeline shows the pointer leak in their proof of concept took about 48 minutes, followed by about five minutes to run the command.
Technical details reported by vendors
The public CVE record and Anthropic’s description do not match exactly. Ubuntu’s entry for CVE-2026-98432 (published October 15, 2026 and updated October 28) gives the bug a CVSS v3 score of 9.8 (Critical). The vendor write-up attributes the problem to tcp_v4_syn_recv_sock() handing IP options to a child socket without copying them; a concurrent CPU can process a repeated SYN while those options are freed with a plain kfree(), producing a use-after-free in ip_options_build(). The fix switched the free to kfree_rcu() so memory is released only after readers are done. Ubuntu’s record notes IPv6 is not hit by the first issue. The CVE text does not mention multipath TCP; the link between Anthropic’s multipath-TCP-focused chain and the CVE rests on Anthropic’s account and has not been independently reproduced in the public record.
Patch status and distribution response
Anthropic says the bug was fixed upstream and backported to maintained stable branches. One security summary lists fixed stable releases such as 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113 and 6.18.56, though readers are advised to confirm numbers on kernel.org. Distribution patching is uneven: at the time of reporting Ubuntu marked 22.04, 24.04 and 26.04 kernels as vulnerable with work in progress, and older LTS releases such as 20.04 and 18.04 as vulnerable. Many cloud-provider kernels (AWS, Azure, GCP) were also listed as affected. Some vendors, including Oracle Linux, reported shipping fixed packages. The coverage differences mean internet-facing and cloud-hosted kernels should be prioritized in patch plans.
Mitigation and short-term recommendations
Install the latest kernel updates from your distribution and reboot systems—kernel fixes only take effect after a restart. If a vendor patch is not yet available, consider whether services that use multipath TCP are necessary and disable them where possible. Restrict exposure of public services with firewall rules and monitor listening ports for odd resets or repeated failed handshakes that could indicate exploitation attempts. Prioritize patching internet-facing servers and cloud instances.
Wider implications and context
Anthropic framed the finding as evidence that modern AI models can now assist in discovering and chaining bugs into working exploits with less human effort—capabilities that defenders can also harness. The company highlighted that the same tools have helped write kernel patches and pointed to its Cyber Verification Program for vetted security researchers. Observers caution that the precise attack path tying Anthropic’s multipath TCP chain to the CVE is presently supported primarily by Anthropic’s report; other teams have not yet publicly reproduced the full chain end-to-end. The episode follows other recent AI-related security discussions, including coverage of a Claude Cowork sandbox flaw that allowed root access inside that product’s Linux sandbox. As always, treat AI-produced exploits in lab reports as a signal that discovery-to-exploit timelines may be shrinking and accelerate patching and scanning accordingly.
Licensed under CC BY-ND 4.0 International