Anthropic says an unreleased Claude research model wrote a working exploit for a critical Linux kernel bug, tracked as CVE-2026-98432. The exploit lets a remote attacker run commands as root with no login and no user action.
Anthropic’s Frontier Red Team shared the finding on October 27, 2026, and the flaw is already patched upstream. Anthropic’s research post says this was a lab test and not a real-world incident.
After a first prompt from a researcher, Claude wrote an exploit that targets Linux servers with a multipath TCP listener. Anthropic describes the root cause as a race condition that leads to a use-after-free bug in the kernel networking stack. A use-after-free happens when code keeps using memory after the system has already released it.
Claude AI Exploits Critical Linux Kernel Flaw
The exploit works in two steps. First, it abuses the race to make the kernel send back extra bytes, and one reply can contain a kernel pointer. That pointer reveals the memory layout and defeats KASLR, a defense that hides where kernel code sits. Second, the same bug overwrites a callback pointer so the kernel runs a payload the attacker already placed in memory, which ends in a shell command as root.
Anthropic notes that a lost race only fails the TCP handshake and does not crash the machine. An attacker can therefore retry again and again. In the proof of concept, leaking the pointer took 48 minutes and running the command took five more. Our own earlier report on the full Claude exploit research covers the Chrome, Safari, Android and Windows chains from the same study.
The public record looks a little different from Anthropic’s description. The Ubuntu entry for CVE-2026-98432 was published on October 15, 2026 and last updated on October 28. It carries a CVSS 3 score of 9.8, which is Critical, and an Ubuntu priority of High.
The text describes an IPv4 fix named “free inet_opt and ireq_opt after an RCU grace period.” It explains that tcp_v4_syn_recv_sock() hands IP options to a child socket without copying them. Another CPU can then process a repeated SYN and build a reply while the options are freed with a plain kfree(), which causes the use-after-free in ip_options_build(). The fix switches to kfree_rcu(), which delays the free until readers are done. The record says IPv6 is not hit by the first issue.
The record never mentions multipath TCP. The link between the CVE and Anthropic’s Linux chain rests on Anthropic’s post, a gap that Cyber Security News also pointed out. Readers should treat the exact attack path as the vendor’s claim until others reproduce it. A threat summary from Aviatrix states the same caution, since no outside team has confirmed the chain end to end.
Patch Status
Anthropic says the bug was fixed upstream and backported to all maintained stable kernel branches. One security blog lists fixed stable releases such as 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113 and 6.18.56, though readers should confirm those numbers on kernel.org.
Distribution fixes are uneven. At the time of writing, Ubuntu’s page marks 22.04, 24.04 and 26.04 kernels as vulnerable with work in progress, and older releases such as 20.04 and 18.04 as vulnerable. Many cloud kernels for AWS, Azure and GCP are also listed as affected.
One patch guide reports that Oracle Linux has shipped fixed packages. Internet-facing servers should come first in any patch plan.
The bigger story is speed. Anthropic argues that models can now find and chain bugs into working exploits with little human help. That work once needed a small group of expert teams. Defenders can use the same tools, and Anthropic points to its expanded Cyber Verification Program for approved security staff.
AI is also moving into kernel work from the safe side. Linus Torvalds recently said Claude Code helped write Linux kernel patches, which shows the same tools help both builders and bug hunters.
Install the latest kernel update from your distribution and reboot, since a kernel fix does not apply until the system restarts. If a patch is not ready, check whether you really need multipath TCP listeners and turn them off where you do not. Limit exposure of public services with firewall rules, and watch for odd resets or failed handshakes on listening ports.
Teams that run AI tools should also review their own setups. We recently covered a Claude Cowork sandbox flaw that let an attacker reach root inside the product’s Linux sandbox. Scan your own code often, patch fast, and treat AI-found bugs as a sign that the gap between discovery and exploit is shrinking.
