Hexa Tiger 
Scale My Publication 
SEO for Public Figures 
A Linux Kernel Flaw tracked as CVE-2026-98432 gave an unreleased Claude research model a path to run commands as root in a lab test, Anthropic says. The company said its Frontier Red Team shared the finding on October 27, 2026, and stressed that the test was not a real-world incident.
The exploit targeted Linux servers with a multipath TCP listener. Anthropic described the underlying bug as a race condition that leads to a use-after-free in the kernel networking stack. In that condition, code continues using memory after the system has released it.
How the Linux Kernel Flaw Exploit Worked
Anthropic said a researcher first prompted Claude, after which the model wrote a working exploit. The attack used two stages. It first triggered the race so the kernel returned extra bytes, including a kernel pointer in one reply. That pointer exposed memory layout information and defeated KASLR, which hides where kernel code sits.
The exploit then overwrote a callback pointer. That change made the kernel run a payload already placed in memory, ending with a shell command executed as root. A lost race failed the TCP handshake without crashing the machine, Anthropic said, allowing an attacker to retry.
In the proof of concept, obtaining the pointer took 48 minutes, followed by five more minutes to run the command. The reported sequence shows how the Linux Kernel Flaw could be chained, though the source notes that no outside team had confirmed the chain end to end.
Public Records and Patch Status
The public vulnerability record presents a different technical account. Ubuntu’s CVE-2026-98432 entry was published on October 15, 2026 and last updated on October 28. It assigns a CVSS 3 score of 9.8, marked Critical, and an Ubuntu priority of High. Its description concerns an IPv4 fix called “free inet_opt and ireq_opt after an RCU grace period.”
That record says tcp_v4_syn_recv_sock() passes IP options to a child socket without copying them. Another CPU can process a repeated SYN and build a reply while a plain kfree() releases those options, producing a use-after-free in ip_options_build(). The documented fix uses kfree_rcu(), which delays freeing memory until readers finish. The entry says IPv6 is not affected by the first issue and does not mention multipath TCP.
Anthropic says the Linux Kernel Flaw has been fixed upstream and backported to all maintained stable kernel branches. A security blog lists stable releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113 and 6.18.56 as fixed, while advising readers to confirm those numbers at kernel.org. Ubuntu’s page still marked kernels for 22.04, 24.04 and 26.04 as vulnerable with work in progress at the time described. Older 20.04 and 18.04 releases were also listed as vulnerable. AWS, Azure and GCP cloud kernels were listed as affected, while one patch guide reported fixed packages from Oracle Linux.
What Server Operators Should Do
Anthropic recommends installing the latest kernel update from the relevant distribution and rebooting, because the fix does not apply until the system restarts. If a patch is unavailable, the source advises checking whether multipath TCP listeners are needed and disabling them where they are not. It also recommends firewall limits for public services and watching for unusual resets or failed handshakes on listening ports.
These steps matter for shared hosting operators because a vulnerable server may host many customer sites. Separate reports have covered a shared-hosting root access flaw and emergency PHP security fixes. The records concern different software and events; they do not establish that those issues share this exploit.
The report also cautions that the exact link between the CVE record and Anthropic’s multipath TCP attack path rests on Anthropic’s account. Readers should treat that path as the company’s claim until independent teams reproduce it. For now, server teams can follow their distribution’s patch status and apply a released kernel fix with a reboot.
Anthropic argues that AI models can find and combine bugs into working exploits with less human help. It also points to its Cyber Verification Program for approved security staff. The same source says Claude Code has helped write Linux kernel patches, placing AI tools in both defensive and offensive research. The immediate operational step remains clear: install the available distribution update and restart affected servers.
Related reporting has also examined WordPress security fixes as a separate maintenance issue for site operators.
