An unreleased Claude needed 53 minutes to take over Linux servers through a flaw Ubuntu and Red Hat haven’t fixed

A critical flaw in how Linux handles ordinary internet connections now has a working remote takeover exploit, written by an AI model the public can’t use, and two of the biggest Linux distributions haven’t shipped a fix. Anthropic’s Frontier Red Team said on Tuesday that an unreleased, internal Claude research model built an exploit for CVE-2026-98432 that lets an attacker “send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or user interaction.” In Anthropic’s test, the whole attack took about 53 minutes.

The Linux kernel’s own CVE team scores the bug 9.8 out of 10, and Red Hat raised it to Critical on Friday. On Sunday evening, Ubuntu’s security tracker still listed its kernels as “Vulnerable” on every release, and Red Hat’s bulletin still said it “is expediting the release of fixes” for Red Hat Enterprise Linux (RHEL) 8, 9 and 10.

How Claude’s exploit works

The bug sits in the IPv4 TCP handshake, the first packets exchanged when one machine connects to another. The kernel could free options saved from the connecting machine’s IPv4 header while another processor was still reading them: a use-after-free, reachable before any login runs, dating back to Linux 4.4 in 2016. The upstream fix, a four-line change by kernel networking maintainer Eric Dumazet, credits Xinyang Ge of Anthropic as the reporter.

Anthropic describes two stages. First the attacker “defeats KASLR remotely”, tricking the kernel into sending back extra bytes until one reply leaks a kernel memory address. Then the same bug overwrites a callback pointer so the kernel runs a planted payload, ending “with an attacker-chosen shell command running as root.” A lost race “only fails the handshake without crashing the whole system”, so “a determined attacker can retry indefinitely until they succeed.” Leaking the pointer took 48 minutes in Anthropic’s test; reaching the shell took five more.

Anthropic says Claude wrote it “after initial prompting”. It hasn’t published the exploit or named the model.

“The underlying bug is not specific to MPTCP”

The exploit needs a multipath TCP (MPTCP) listener, which is less rare than it sounds: Go’s security team said on Thursday that since Go 1.24, Go programs open MPTCP listeners by default on Linux. It also warned:

While the demonstrated exploit requires the target system to expose an MPTCP listener, the underlying bug is not specific to MPTCP. It is possible that systems with no MPTCP listeners are vulnerable to similar attacks.

Neal Patel, Go security team

Fixed upstream kernels (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3) shipped between October 11 and 18. Debian, SUSE Linux Enterprise Server 16.0 and the 15 LTSS releases, Oracle Linux’s UEK kernels and Amazon Linux have fixed kernels out, and AlmaLinux has them in testing, according to an advisory from security consultancy Atlas, which counted 36 GitHub repositories referencing the CVE by Saturday, at least six claiming a race trigger or proof of concept.

Shopify chief executive Tobi Lütke shared that advisory on X on Saturday:

What a disaster atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf

— tobi lutke (@tobi) October 31, 2026

What Linux admins should do now

• Patch and reboot. Install your distribution’s fixed kernel as soon as it ships, then reboot. Containers use the host’s kernel, so new images don’t help.
• Find MPTCP listeners first. ss -Mlnp lists them; patch those hosts first.
• Filter if you can’t patch. Red Hat’s bulletin gives an nftables rule that drops incoming IPv4 TCP packets carrying IP options, which it says “reduces exposure to this vulnerability but cannot fully prevent it.” AlmaLinux warns that traffic between containers on the same host “may bypass it.”
• Turn MPTCP off if you don’t use it. Setting net.mptcp.enabled to 0 removes the setup Anthropic’s exploit needs, though not the bug. The Go team calls switching it off program by program “a fragile mitigation”.

One of five attack chains

The same model also wrote a one-click Chrome sandbox escape (Google has patched 62 CVEs from the work as of Chrome 156), a Safari chain that bypasses the same-origin policy, an Android lock screen bypass and a remote crash for Windows HTTP/3 servers (CVE-2026-33096). All have been fixed.

It follows Claude’s OpenSSH clean-up and formal proofs that code won’t crash, and an OpenAI model’s part in finding the PHP2Shell flaws. Anthropic says exploit building is now “something models can do with little human involvement”, and points defenders to its Cyber Verification Program. It has already found a downloadable Chinese model that builds working hacks.

Why it matters

An AI model turned a kernel bug into remote root with little help, in under an hour, and the fix still hasn’t reached Ubuntu or RHEL servers. Anthropic kept its exploit private, but the gap between disclosure and patching is the window attackers with their own models will aim for.

Sources: Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude; Red Hat: RHSB-2026-016; Red Hat: CVE-2026-98432; Ubuntu: CVE-2026-98432; Linux kernel fix commit; Go security team via oss-security; AlmaLinux; Atlas advisory; Tobi Lütke on X