Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

Claude research model wrote a root exploit for Linux CVE-2026-98432

Original title: Claude AI Exploits Linux Kernel Flaw to Execute Root Commands Without User Interaction

Cyber Security Newsby Guru Baran ()4 min read3 · 2 reads
Read at cybersecuritynews.com
Part of a story covered by 10 sourcesAnthropic says unreleased Claude built patched lab exploit chainsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Anthropic calls it a lab test, not a real incident; upstream kernels are patched but several Ubuntu releases remain vulnerable.

Anthropic’s Frontier Red Team said on October 27 that an unreleased Claude model produced an exploit for CVE-2026-98432 after one researcher prompt. The company describes a race and use-after-free on servers with a multipath TCP listener, leaking a kernel pointer and then running a command as root. Ubuntu lists CVSS 9.8 and describes an IPv4 options bug fixed with kfree_rcu(). Anthropic says the fix is upstream and backported to maintained stable branches.

Unconfirmed: No outside team has confirmed Anthropic’s chain, and the Ubuntu record never mentions multipath TCP.

Key facts
  • Ubuntu published the CVE entry on October 15 and updated it October 28.
  • A blog lists fixes in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113 and 6.18.56.
  • Ubuntu 22.04, 24.04 and 26.04 were still marked vulnerable, with work in progress.
  • The proof of concept took 48 minutes to leak a pointer, then five more.
  • The Ubuntu write-up does not mention multipath TCP.
Security assessment · AI, from the articlePublic proof of concept

Impact: remote command execution as root without login

ProductAffectedFixed in
Linux kernel—5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56
Canonical Ubuntu kernel22.04, 24.04, 26.04, 20.04 and 18.04 marked vulnerable—
What to do
  1. 1.Install the latest distribution kernel update and reboot.
  2. 2.Disable unneeded multipath TCP listeners until a patch is installed.
  3. 3.Confirm the listed stable fix versions on kernel.org.
Analyze CVE-2026-98432 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-98432
ATT&CK
T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege Escalation
Tags
linux-kerneluse-after-freeclaudekaslrubuntu
Vendors
Canonical
Products
Linux kernelUbuntu
Organizations
Anthropic
AI models
Claude

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-98432
Use-after-free in Linux kernel IPv4 TCP options
9.8<1%PoC ×15

From the original article

4 min read at cybersecuritynews.com

Anthropic says an unreleased Claude research model wrote a working exploit for a critical Linux kernel bug, tracked as CVE-2026-98432. The exploit lets a remote attacker run commands as root with no login and no user action. Anthropic’s Frontier Red Team shared the finding on October 27, 2026, and the flaw is already patched upstream.

Cyber Security News

By Guru Baran · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.