Anthropic AI model finds Linux kernel bug that leads to remote root access
- Published
- Record updated
Summary
Anthropic disclosed a zero-click exploit, developed with an unreleased Claude research model, that lets an unauthenticated attacker run arbitrary commands as root on Linux servers running an MPTCP listener. The flaw, tracked as CVE-2026-98432, is a race-condition-induced use-after-free in the Linux kernel's IPv4 TCP connection handling, rated 9.8 critical and affecting kernels dating back to version 4.4. Anthropic's proof of concept took about 53 minutes from memory leak to root command execution.
Mitigation
Fixed releases include 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7. Administrators are advised to review their kernel versions, apply the relevant security updates, and assess whether their systems expose MPTCP listeners.
Related items
- Medium“Black October” for AI Developer PlatformsSame vendor · Wiz Research Blog
- MediumCritical Linux kernel flaw allows remote root attacks on MPTCP serversSame vendor · BleepingComputer
- MediumA Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of DevicesSame vendor · Wired (Security)
- InfoThe biggest names in AI are backing a new way to opt out of scrapingSame vendor · The Verge (AI)
- MediumDevs Hit by Trojanized Claude Code Extension for CursorSame vendor · Dark Reading