Claude AI Builds Remote Root Exploit for Linux Kernel TCP Flaw
First merged summary.
Anthropic's Claude model created a zero-click root exploit for CVE-2026-98432 in Linux kernels via MPTCP, with patches rolling out amid ongoing scans.
Anthropic's Frontier Red Team revealed on October 27 that its unreleased Claude research model autonomously built a working exploit for CVE-2026-98432 after one prompt. The race-condition use-after-free in IPv4 TCP connection setup allows unauthenticated remote code execution on servers with multipath TCP listeners, leaking kernel memory and bypassing KASLR. Patches were released for many branches including Red Hat and Debian, but Ubuntu releases 22.04, 24.04 and 26.04 remained vulnerable for weeks with scanning activity reported in the wild.
- CVE-2026-98432 CVSS 9.8 Critical
- Affects kernels back to 4.4
- Claude PoC reached root in 53 minutes
- Fixed in 5.10.272, 6.1.190, 6.12.113+
- Ubuntu fixes in -proposed testing
- Red Hat RHSA-2026:93414 shipped
Timeline
dated events in the reporting · oldest first- Oct 5, 2026Kernel developers fixed TCP race condition · The Hacker News
- Oct 15, 2026Ubuntu published CVE-2026-98432 entry · Cyber Security News
- Oct 27, 2026Anthropic disclosed Claude model exploit · GBHackers
- Oct 28, 2026Ubuntu updated CVE and backport notes · CSO Online
- Oct 30, 2026Debian Oracle Linux shipped fixes · The Hacker News
- Nov 2, 2026Ubuntu put patches in -proposed pocket · Cyber Security News
What each outlet adds
beyond the shared facts- Fortinet PSIRTDetailed race condition in tcp_v4_syn_recv_sock and RCU grace period mitigation.
- CSO OnlinePoC execution time of 53 minutes and eight kernel branches affected since 4.4.
- The Hacker NewsDistribution status including Ubuntu Red Hat and interim nftables mitigation.
- Cyber Security NewsScanning activity on port 443 with MPTCP as of November 2.
- Red HatShipped RHSA patches for RHEL 8.10 9.8 and 10.2 with CVSS 9.8 rating.
Coverage
oldest first · one row per article · UTC- · 6d ago
The Hacker NewsFirst report
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
- · 6d ago
Malwarebytes Labs
Chrome 156 and Firefox 159 patch critical memory-safety flaws
Google shipped 52 fixes, four rated Critical, and Mozilla fixed 167 bugs; both credited AI-assisted bug finding.
- · 6d ago
Cyber Security News
Unreleased Claude model wrote Chrome, Linux and Android exploit chains
Anthropic says the lab-only chains were reported first and fixed, including Chrome 156, with no real-world incidents.
- · 6d ago
GBHackers
Anthropic says unreleased Claude built Chrome, Android and Linux exploits
Vendors were notified first; Chrome 156 fixed 62 CVEs, and the Linux root flaw is CVE-2026-98432.
- · 6d ago
SecurityWeek
Chrome 156 and Firefox 159 patch more than 200 flaws
CVE-2026-118306 can run arbitrary code outside Chrome's sandbox from a crafted HTML page; no in-the-wild exploitation is mentioned.
- · 5d ago
Claude research model wrote a root exploit for Linux CVE-2026-98432
Anthropic calls it a lab test, not a real incident; upstream kernels are patched but several Ubuntu releases remain vulnerable.
- · 5d ago
Linux TCP use-after-free scored 9.8; Ubuntu and RHEL unfixed
Anthropic says Claude built a remote root exploit via MPTCP, a link absent from the CVE and fix.
- · 5d ago
Dark Reading
Unreleased Claude built exploit chains for Chrome, Safari, and major OSes
Anthropic says the model made five exploits, including Android data theft and Linux root code execution; vendors have patched.
- · 5d ago
Hacker News · security
Linux TCP use-after-free CVE-2026-98432 yields lab remote root
Upstream CVSS is 9.8 and Red Hat scores 5.9; Anthropic’s root chain used a lab Multipath TCP listener.
- · 4d ago
Linux kernel TCP use-after-free CVE-2026-98432 can crash Ubuntu
Ubuntu lists kernels through 22.04 LTS as affected, with fixes still in progress and no confirmed exploitation.
- · 4d ago
The Decoder
GLM 5.3 built Firefox exploit chains from public patch gaps
Epoch AI says each successful chain cost about $1,000 and Mozilla fixed the rediscovered bug in Firefox 159.0.
- · 4d ago
CSO Online
Linux MPTCP flaw enables remote root; Anthropic shows exploit (CVE-2026-98432)
The kernel use-after-free scores 9.8, hits branches back to 4.4, and needs an exposed MPTCP listener.
- · 4d ago
Lobsters · security
Go team warns CVE-2026-98432 can give RCE via MPTCP
Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.
- · 4d ago
BleepingComputer
Linux kernel TCP flaw CVE-2026-98432 allows remote root on MPTCP servers
Anthropic says an unreleased Claude model built a root exploit in about 53 minutes; no in-the-wild attacks are confirmed.
- · 4d ago
Canadian Centre for Cyber Security
Linux before several 5.x–7.x releases affected by CVE-2026-98432
Canada’s Cyber Centre urges administrators to review the linked material and apply updates when available.
- · 4d ago
Hacker News · security
Akamai investigates Linode exposure to RCE CVE-2026-98432
The status page says mitigation is underway and the platform is being monitored, with no confirmed compromise.
- · 3d ago
oss-security
init_on_free=1 added as interim mitigation for CVE-2026-98432
init_on_free=1 kernel boot parameter serves as additional mitigation for nftables and MPTCP issues.
- · 3d ago
Hacker News · security
Linux kernel TCP UAF CVE-2026-98432 rated Critical
Anthropic researcher reported a PoC for remote root access on Linux servers with multipath TCP listeners.
- · 1d ago
Fortinet PSIRT
Linux kernel CVE-2026-98432 enables unauthenticated RCE
The race condition in TCP SYN handling for IPv4 allows unauthenticated remote code execution in the Linux kernel.
- · 1d ago
SANS Internet Storm Center
MPTCP TCP option detection methods described
MPTCP uses TCP option 30 for multi-path connections and can be detected with Wireshark or tcpdump.
- · 1d ago
Lobsters · security
Ubuntu delays critical Linux kernel TCP vulnerability patch
Ubuntu has not patched CVE-2026-98432 which allows remote root on servers, despite Debian and others shipping the fix.
- · 1d ago
Hacker News · security
Ubuntu LTS kernels lack patch for critical CVE-2026-98432
No fixed kernels released for Ubuntu 22.04, 24.04 or 26.04 despite CVSS 9.8 rating for CVE-2026-98432, leaving systems exposed for nearly three weeks.
- · 1d ago
Akamai Blog
Linux Kernel TCP Stack Remote Use-After-Free Vulnerability
Akamai reports on CVE-2026-98432, a remote use-after-free flaw in the Linux kernel TCP stack.
- · 21h ago
Ubuntu Releases Early Fixes for Linux Kernel RCE Flaw
Ubuntu provides early kernel fixes for CVE-2026-98432 allowing root RCE via use-after-free in TCP connections; attackers scanning in the wild for affected systems.
- · 20h ago
Ubuntu releases fixes for critical Linux kernel RCE vulnerability
CVE-2026-98432 use-after-free in IPv4 TCP handling fixed in proposed updates for Ubuntu 22.04 and newer.
- · 18h ago
Red Hat Patches Critical Linux TCP RCE Flaw CVE-2026-98432
Red Hat released fixed kernels for RHEL 8, 9 and 10 while Ubuntu keeps updates in testing channel.
- · 16h ago
Lobsters · security
Canonical lags in patching critical CVE-2026-98432
Canonical has not released the fix for CVE-2026-98432 in main Ubuntu repositories despite rapid patching by Debian and Red Hat.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33096 | Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network | 7.5 | 1% | ||
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |