Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to run commands as root on servers running Multipath TCP listeners. The flaw, tracked as CVE-2026-98432, is a use-after-free bug in the kernel's IPv4 TCP networking code, rated 9.8 out of 10 by the Linux kernel CVE team. Anthropic said an unreleased Claude research model built the exploit, which bypassed kernel address space layout randomisation and reached root in about 53 minutes in its demonstration.

How the flaw works

The bug sits in how the kernel handles IP options during IPv4 TCP connection setup. When a new connection is created, ownership of those options can pass to the new socket without a separate copy, and if another processor is still using them to build a response, the kernel can end up reading memory that has already been freed. That race condition can crash a server or, in the configuration Anthropic exploited, hand an attacker control. The flaw affects kernels dating back to version 4.4, including widely used distributions such as Ubuntu and Red Hat Enterprise Linux, and programs built with Go 1.24 or later open listening sockets with Multipath TCP by default.

Patch status — and the disagreement over severity

Fixed kernels have been released upstream, including versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113 and 6.18.56, although some distributions had not shipped patched packages as of 30 October. The severity picture is contested: Red Hat rates the flaw lower, at 5.9, than the kernel team's 9.8, and CloudLinux said its team could not reproduce Anthropic's remote-root claim. No exploitation in the wild has been reported, the exploit itself has not been published, and the flaw was not in CISA's exploited-vulnerabilities catalogue as of 30 October — so administrators should treat this as a patch promptly, not as an active attack wave.