Anthropic exploit scores remote root on Linux via CVE-2026-98432
Anthropic researchers used Claude to build an exploit for the 9.8-rated kernel flaw, reaching remote root in about 53 minutes as distributors patch.
Security researchers at Anthropic developed a working exploit for a critical Linux kernel vulnerability tracked as CVE-2026-98432, reaching remote root command execution on a Linux server running an MPTCP listener, according to bleepingcomputer.com. The Linux kernel CVE team scored the flaw 9.8 out of 10.
The vulnerability is a use-after-free bug in the kernel's IPv4 TCP networking code, triggered by a race condition in how TCP connection requests are handled. It affects Linux kernels from version 4.4 onward, including builds used by Ubuntu, Red Hat Enterprise Linux and Rocky Linux.
According to Anthropic, the exploit bypassed KASLR and achieved remote root code execution in about 53 minutes. The company said the work was carried out with its Claude model.
Patch status varies by distribution
The flaw has been fixed in the upstream Linux kernel and backported to maintained branches, but distribution trackers show uneven coverage. As of October 30, Canonical listed Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as still vulnerable. Red Hat lists RHEL 8, 9 and 10 as affected and RHEL 7 as unaffected. Debian shipped fixes in kernel package 6.1.190-1 for Debian 12 and 6.12.113-1 for Debian 13.
Multipath TCP lets a single connection use multiple network paths for performance and reliability. It is not typically enabled by default, but Go 1.24 turns MPTCP on automatically for TCP listeners on Linux when the kernel supports it. macOS is not affected because it uses Apple's XNU kernel.
Red Hat rated the flaw 5.9, classifying it as a potential denial-of-service issue on the grounds that exploitation is complex.
Quick answers
What is CVE-2026-98432?
It is a use-after-free flaw in the Linux kernel's IPv4 TCP networking code caused by a race condition in TCP connection request handling. It affects kernels from version 4.4 onward and is scored 9.8 out of 10.
Which Linux distributions are affected?
Red Hat lists RHEL 8, 9 and 10 as affected, while RHEL 7 is not. As of October 30, Canonical listed Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as still vulnerable. Debian fixed the issue in kernel 6.1.190-1 for Debian 12 and 6.12.113-1 for Debian 13.
Does the flaw affect macOS?
No. macOS uses Apple's XNU kernel and is not affected.