Claude builds root exploit for Linux kernel flaw; Ubuntu and RHEL still unpatched

What it's about

On October 27, 2026, Anthropic's Frontier Red Team published a research report. It shows that an as-yet unreleased internal Claude model built working attacks on widely used software. One of them targets the Linux kernel: the vulnerability CVE-2026-98432 lets an attacker take over vulnerable servers remotely. The attacker needs no password and no action from the user (a so-called zero-click attack), and ends up with root privileges, meaning full control of the system.

The bug itself has been fixed in the main Linux branches since early October. But some major distributions are still missing the updates.

How the flaw works

The problem lies in how the kernel handles TCP connections over IPv4. According to the kernel CVE notice (quoted by CSO Online and ShiftDelete), when a connection is set up, the kernel passes the IP options of a pending connection request on to the new socket without copying them. A socket is, roughly speaking, the endpoint of a network connection.

If another CPU core is simultaneously processing a retransmitted request and building the SYNACK reply (the acknowledgment in the TCP handshake) from it, it can access memory that has already been freed. This is called a use-after-free. Because the bug depends on the random timing of two cores, it is a race condition.

The fix delays freeing the affected objects until an RCU (Read-Copy-Update) grace period has passed. That gives parallel readers time to finish.

Claude's attack

Starting from initial guidance by the researchers, Claude wrote an exploit that targets Linux servers with a Multipath TCP (MPTCP) listener. MPTCP lets you bundle several network interfaces into one connection, for example for more bandwidth or resilience. It is optional: applications have to request it, although eBPF, for example, can also force it.

The exploit works in two stages:

• Bypass KASLR: KASLR is a protection that randomizes the kernel's memory addresses. The attacker wins the race so that the kernel sends back extra bytes and leaks a kernel pointer. In testing, this took about 48 minutes.
• Hijack control flow: The same bug overwrites a callback pointer, so a shell command of the attacker's choice runs as root. This took about five more minutes.

A lost race only makes the handshake fail; the server doesn't crash. The attacker can therefore try as often as they like. Anthropic has not released the exploit code, nor exact kernel version details.

Affected versions and patch status

According to CSO Online and ShiftDelete, the flaw goes back to Linux 4.4 and affects eight kernel branches. The fixed upstream versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7.

Severity ratings differ. In several reports the CVE carries a CVSS score of 9.8 (critical). According to ShiftDelete, Red Hat rates it "Important" with a provisional 8.1, because winning the race means high attack complexity. The dossier from the main source, by contrast, says Red Hat classed it as critical in its own advisory and temporarily recommends filtering certain network packets with a firewall. ShiftDelete, however, writes that Red Hat sees no suitable mitigation. These accounts contradict each other, and the question remains open.

Part of a larger study

According to CSO Online and Pragativadi, Anthropic presented five attack chains: Chrome (one-click code execution; Google assigned 62 CVEs and patched in Chrome 156), Safari (same-origin policy bypass), Android (lock screen bypass on the Pixel 9), Windows (remote crash via QUIC, CVE-2026-33096) and, finally, Linux. Anthropic stresses that all findings were reported to vendors through coordinated disclosure; ShiftDelete cites a 90-day deadline.

What admins should do

• Check the kernel version you're running.
• Install the patched distribution kernel as soon as it's available, and reboot.
• Check whether any services expose MPTCP listeners to the internet.
• Don't rely on switching off a single feature: the bug sits in the general IPv4 TCP code. According to the main source, it's unclear whether systems without MPTCP are similarly vulnerable.

Context

The case shows that AI models no longer just find bugs; they turn them into complete attacks. That helps defenders review code, but it also lowers the barrier to entry for attackers, as analysts warn, according to Pragativadi. Keep in mind: all details about the exploit come from Anthropic itself and haven't been independently verified. The model is unreleased and the code is secret. The practical risk is probably limited by the high complexity and long runtime, and no attacks are known so far. Still, operators of exposed servers should patch quickly.