A newly disclosed Linux kernel vulnerability, tagged CVE-2026-98432, has been shown to allow remote attackers to execute commands as root—with no login or user intervention—by leveraging an exploit generated by an unreleased model of Claude AI. The find was revealed by Anthropic’s Frontier Red Team on October 27, 2026; the flaw has already been patched in upstream kernel versions. It’s important to note this remains a lab test and not a confirmed real‐world breach.
How the Exploit Works
The exploit leverages a race condition in the Linux kernel’s networking stack, leading to a “use‐after‐free” error. After one crafted prompt, Claude AI produced a working exploit that targets Linux servers running a multipath TCP listener. The bug unfolds in two stages: first, the attacker induces the kernel to send extra data in a reply—potentially exposing a kernel pointer. That pointer helps defeat KASLR (Kernel Address Space Layout Randomization), a kernel security feature that hides where key code resides. Second, the exploit overwrites a callback pointer, causing the kernel to run attacker-supplied code, executing a root shell command.
Although the exploit chain assumes multipath TCP is in use, upstream patch descriptions (such as Ubuntu’s) focus on a separate issue involving IPv4 TCP connections. That bug arises because functions handling IP options pass pointers to child sockets without copying them; when another CPU processes a SYN packet before memory is freed by kfree(), a use-after-free happens in ip_options_build(). The fix replaces plain kfree() with kfree_rcu(), delaying memory freeing until after current readers finish. IPv6 is said to be unaffected by this specific part of the issue.
Severity, Patch Status & Mitigation
The Ubuntu entry for CVE-2026-98432 carries a CVSS 3.0 severity rating of 9.8 (“Critical”) and is flagged as high priority. Ubuntu kernels in its long-term releases 22.04, 24.04, and 26.04 are still marked vulnerable, while older releases like 20.04 and 18.04 are confirmed affected with fixes pending. Cloud environments—specifically AWS, Azure, and GCP kernels—are also listed among those exposed.
Anthropic reports that the issue has been fixed upstream and backported to all maintained stable kernel branches. Examples of patched versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, and 6.18.56, though users are advised to verify exact versions via trusted kernel sources. Some distributions, like Oracle Linux, have already released updates; Ubuntu is still working through fixes and rollout.
Until this is fully patched, server operators should reboot systems after installing kernel updates. If multipath TCP isn’t essential, disable it. Externally exposed services should be firewalled, and strange behaviors such as unexpected TCP handshake failures or port resets should be investigated closely.
Anthropic emphasizes that this incident signals a shift: AI is now driving not just vulnerability discovery, but full exploit chaining. The same kind of tooling that finds issues is also helping write fixes. Kernel maintainer Linus Torvalds has noted that Claude Code contributed to some kernel patches. Teams using AI internally should audit their pipelines, patch swiftly, and treat AI-found bugs as a warning that exploit capability is becoming faster and more accessible.
This episode isn’t just another kernel bug—it’s a wake-up call. As AI models increasingly write working exploits, the speed between bug discovery and weaponization shrinks. The security world must adapt: faster patch deployment, hardened kernel subsystems, and tighter controls over who has access to research-grade models. Monitor your patch levels, control risky features like multipath TCP, and assume an exploit found in lab may find its way into the wild.
