Anthropic says its AI model built a working root exploit for critical Linux kernel flaw CVE-2026-98432
- Severity
- Critical
- Highest CVSS
- 9.8
- Exploited
- Not known
- Sources
- 6
What happened
CVE-2026-98432 is a race-induced use-after-free in the Linux IPv4 TCP path: tcpv4synrecvsock() passes IP options to the child socket without copying, and a concurrent SYN retransmission reading them via ipoptionsbuild() can hit freed memory, fixed by deferring the free with kfreercu(). The CVE record gives CVSS 3 9.8 and lists fixes in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3, with branches back to 4.4 affected. Anthropic's chain targets MPTCP listeners and defeats KASLR, a link the CVE record does not mention and that no outside team has confirmed. Patch promptly, prioritise exposed servers, disable unneeded MPTCP listeners, and filter public ports.
For security analysts · Written by AI from 6 sources · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Vulnerabilities
Full story timeline · 7 updates
- Thu 15 OctoberCVE-2026-98432 published, CVSS 9.8NVD
- Thu 29 OctoberClaude AI Exploits Linux Kernel Flaw to Execute Root Commands Without User InteractionCyber Security News
- Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other DistributionsThe Hacker News
- Fri 30 OctoberCritical Linux Kernel Vulnerability Lets Remote Attackers Crash Ubuntu SystemsGBHackers
- Anthropic AI model finds Linux kernel bug that leads to remote root accessCSO Online
- Linux security advisory (AV26-1108)Canadian Centre for Cyber Security
- Sat 31 OctoberCVE-2026-98432 - Linux kernel IPv4 TCP use-after-free IssueAWS Security Bulletins
Who reported · 6 outlets
Who and what is in it
Companies