CriticalBreachCVE-2026-98432
Claude AI Exploits Linux Kernel Flaw to Execute Root Commands Without User Interaction
Cyber Security News·Source published ·1 min read
What happened?
Anthropic says an unreleased Claude research model wrote a working exploit for a critical Linux kernel bug, tracked as CVE-2026-98432. The exploit lets a remote attacker run commands as root with no login and no user action. Anthropic’s Frontier Red Team shared the finding on October 27, 2026, and the flaw is already patched upstream. Anthropic’s research post says this was a lab test and not a real-world incident. After a first prompt from a researcher, Claude wrote an exploit that targets Linux servers with a multipath TCP listener.
Key details
- Anthropic's Claude research model created an exploit for a critical Linux kernel vulnerability.
- The exploit allows remote command execution as root without login or user interaction.
- The vulnerability is a race condition in the kernel networking stack causing a use-after-free bug.
- The exploit defeats KASLR by leaking a kernel pointer through an extra TCP reply byte.
- The same bug overwrites a callback pointer to execute attacker-controlled payload in memory.
Affected
- Linux kernels with multipath TCP listener are affected according to Anthropic's claim.
- Ubuntu kernels 22.04, 24.04 and 26.04 are listed as vulnerable with work in progress.
- Older Ubuntu releases 20.04 and 18.04 are listed as vulnerable.
- Many cloud kernels for AWS, Azure and GCP are listed as affected.
Fixes and mitigations
- Fixed stable releases include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113 and 6.18.56.
- Oracle Linux has shipped fixed packages.
- Switch from kfree() to kfree_rcu() for IP options in tcp_v4_syn_recv_sock() to delay free until readers done.
What to look for
- Odd resets or failed handshakes on listening TCP ports may indicate exploitation attempts.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.