Anthropic says its AI model wrote a working exploit for CVE-2026-98432, a Linux kernel flaw that the kernel’s own CVE team rates 9.8 out of 10 on the CVSS scale. The exploit lets a remote attacker with no credentials run commands as root. It works against Linux servers that run a multipath TCP listener. Server administrators now face a race to patch this critical Linux vulnerability.
What Is the CVE-2026-98432 Linux Kernel Flaw?
The bug is a race condition in the code that sets up new IPv4 TCP connections. It makes the kernel read memory it has already freed, a bug type known as a use after free. The defect dates back to kernel version 4.4. The flaw affects only IPv4, so IPv6 only traffic avoids the vulnerable code path. Because the kernel handles every TCP handshake, this Linux security flaw sits in a core part of the networking stack.
How the AI Built Exploit Gained Remote Root Access
Anthropic’s research produced an exploit that bypassed KASLR and reached root command execution on an MPTCP enabled server in about 53 minutes. That speed shows how fast AI assisted exploit development has become. Treat the claim with care, though. Anthropic has not published the exploit code, the kernel version or the test configuration. Nobody knows yet whether a server without MPTCP falls to the same attack. Red Hat’s CVE page rates the flaw Moderate at 5.9, because the race is hard to win.
Linux Kernel Patch Status for Ubuntu, RHEL and Other Distributions
Patch availability varies by distribution. Oracle Linux and Debian trixie shipped fixes on October 16. As of October 30, Ubuntu and Red Hat Enterprise Linux still had no fixed kernel. Administrators should check their exact release and kernel flavor, install the update the moment it lands and reboot so the new kernel takes effect. Teams that build their own kernels can use the fixed stable releases. These include 6.12.113, 6.18.56 and 7.3. Until your distribution ships a patch, monitor vendor advisories and limit exposure of public facing TCP services.