Anthropic researchers have built an exploit for CVE-2026-98432, a use-after-free flaw in the Linux kernel's TCP code that gives unauthenticated remote root command execution on servers with a Multipath TCP listener, BleepingComputer reports. Kernels back to version 4.4 are affected, in distributions such as Ubuntu, RHEL and Rocky Linux. According to Anthropic, an unreleased Claude model reached root in about 53 minutes, while Red Hat rates the bug lower because exploitation is complex. The upstream kernel is fixed, but distributions are rolling out patches gradually.

What it means: The gap between the 9.8 score and Red Hat's 5.9 shows how hard it is to rate flaws that depend on race conditions. Until now such bugs were considered hard to exploit in practice, but an AI model that reaches a working exploit in under an hour changes that assumption. A practical point many people miss is that since Go 1.24, services written in Go enable MPTCP by default when the kernel supports it. A server can therefore expose a listener without anyone having decided to. For Greek companies running Linux in the cloud or on their own hardware, this means checking with tools such as ss for active MPTCP sockets, applying kernel updates as soon as they ship and actually rebooting, which is often postponed. Where the fix has not arrived yet, disabling MPTCP through sysctl settings is a sensible stopgap. The episode also strengthens the case for automated patch management, because the time from disclosure to exploitation keeps shrinking.

Read the original on BleepingComputer

Related service: Custom software

Related stories