--- title: Anthropic AI model finds Linux kernel bug that leads to... description: An unreleased Anthropic Claude research model developed a zero-click exploit for a Linux kernel flaw that grants remote root access without user interaction.... canonical: https://daily.dev/posts/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access-cieoxorak twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anthropic AI model finds Linux kernel bug that leads to remote root access | daily.dev og:description: An unreleased Anthropic Claude research model developed a zero-click exploit for a Linux kernel flaw that grants remote root access without user interaction.... og:url: https://daily.dev/posts/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access-cieoxorak og:image: https://api.daily.dev/og/posts/cIeoxORak.png og:image:alt: Anthropic AI model finds Linux kernel bug that leads to remote root access og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anthropic AI model finds Linux kernel bug that leads to remote root access **[CSO Online](https://daily.dev/sources/csoonline)** · 3 min read · 0 upvotes · 1 comments ## Summary An unreleased Anthropic Claude research model developed a zero-click exploit for a Linux kernel flaw that grants remote root access without user interaction. The bug, tracked as CVE-2026-98432, is a race-condition use-after-free in how the kernel handles IP options during TCP connection setup, scoring 9.8 in severity. Anthropic's proof of concept went from an initial memory leak to root-level command execution in about 53 minutes, targeting servers running MPTCP listeners. The flaw affects eight kernel branches back to version 4.4. Fixes exist for 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7, but Ubuntu and RHEL had not shipped patched kernels as of October 30. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-98432 and how severe is it? CVE-2026-98432 is a critical Linux kernel use-after-free vulnerability with a severity score of 9.8, caused by a race condition in how IP options are handled during IPv4 TCP connection establishment. It allows an unauthenticated remote attacker to leak kernel memory, defeat KASLR, hijack kernel control flow, and execute commands as root. It affects eight kernel branches dating back to version 4.4. _Teams tracking critical kernel CVEs like this one can follow patch status across distros on daily.dev._ ### Which Linux kernel versions fix the MPTCP use-after-free vulnerability CVE-2026-98432? Fixed kernel releases include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. Debian, Oracle Linux, SUSE, and Amazon Linux had fixed packages available for at least some releases, while Ubuntu and Red Hat Enterprise Linux had not yet released patched kernels as of October 30. _Admins deciding when to patch production kernels can keep tabs on distro rollout status via daily.dev._ ### How did an AI model discover and exploit the Linux kernel MPTCP vulnerability? An unreleased Anthropic Claude research model built a zero-click exploit chain requiring no user interaction, going from an initial kernel memory leak to root-level command execution in about 53 minutes. It targeted Linux servers running MPTCP listeners, exploiting a race condition that frees a child socket's IP options while another CPU is still reading them during SYNACK construction, triggering a use-after-free. _Developers gauging how AI changes vulnerability discovery can follow results like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@yonasuriv** · 0 upvotes > The MPTCP listener requirement sounds niche, but if you run Go services it might not be. Since Go 1.24, net.ListenConfig uses MPTCP by default on Linux, so an ordinary Go server can already have the kind of listener the PoC needed. GODEBUG=multipathtcp=0 (or godebug multipathtcp=0 in go.mod) turns that off, but the Go security team calls it a fragile mitigation and points out the underlying bug isn't MPTCP-specific, so the real fix is a patched kernel (6.12.113, 6.18.56, 7.2.10). `ss -Mltn` is a quick way to see which MPTCP listeners you actually have. ## Similar posts on daily.dev - [Claude Mythos Preview \\ red.anthropic.com](https://daily.dev/posts/claude-mythos-preview-red-anthropic-com-wkjczmbgu) · Hacker News · 5 upvotes · 0 comments - [Claude Code Used to Find Remotely Exploitable Linux Kernel Vulnerability Hidden for 23 Years](https://daily.dev/posts/claude-code-used-to-find-remotely-exploitable-linux-kernel-vulnerability-hidden-for-23-years-vni2dtvdh) · InfoQ · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#vulnerability](https://daily.dev/tags/vulnerability), [#claude](https://daily.dev/tags/claude), [#anthropic](https://daily.dev/tags/anthropic) [View this post on daily.dev](https://daily.dev/posts/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access-cieoxorak) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Anthropic AI model finds Linux kernel bug that leads to remote root access","url":"https://daily.dev/posts/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access-cieoxorak","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access-cieoxorak"},"datePublished":"2026-10-30T12:30:28.605Z","dateModified":"2026-10-31T20:21:14.795Z","description":"An unreleased Anthropic Claude research model developed a zero-click exploit for a Linux kernel flaw that grants remote root access without user interaction....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a68927d99da4e90d044007a3f943403a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a68927d99da4e90d044007a3f943403a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access-cieoxorak","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"linux,vulnerability,claude,anthropic","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Anthropic AI model finds Linux kernel bug that leads to remote root access"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access-cieoxorak","comment":[{"@type":"Comment","text":"The MPTCP listener requirement sounds niche, but if you run Go services it might not be. Since Go 1.24, net.ListenConfig uses MPTCP by default on Linux, so an ordinary Go server can already have the kind of listener the PoC needed. GODEBUG=multipathtcp=0 (or godebug multipathtcp=0 in go.mod) turns that off, but the Go security team calls it a fragile mitigation and points out the underlying bug isn’t MPTCP-specific, so the real fix is a patched kernel (6.12.113, 6.18.56, 7.2.10). ss -Mltn is a quick way to see which MPTCP listeners you actually have.","datePublished":"2026-10-31T12:55:23.719Z","url":"https://daily.dev/posts/cIeoxORak#c-ZW5RnNpXe","author":{"@type":"Person","name":"Livewire","url":"https://daily.dev/yonasuriv","image":"https://media.daily.dev/image/upload/f_auto/v1656022362/avatars/jzd0XPKYw5GfG2OJ9TZtJ"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-access-cieoxorak#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-98432 and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-98432 is a critical Linux kernel use-after-free vulnerability with a severity score of 9.8, caused by a race condition in how IP options are handled during IPv4 TCP connection establishment. It allows an unauthenticated remote attacker to leak kernel memory, defeat KASLR, hijack kernel control flow, and execute commands as root. It affects eight kernel branches dating back to version 4.4. Teams tracking critical kernel CVEs like this one can follow patch status across distros on daily.dev."}},{"@type":"Question","name":"Which Linux kernel versions fix the MPTCP use-after-free vulnerability CVE-2026-98432?","acceptedAnswer":{"@type":"Answer","text":"Fixed kernel releases include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. Debian, Oracle Linux, SUSE, and Amazon Linux had fixed packages available for at least some releases, while Ubuntu and Red Hat Enterprise Linux had not yet released patched kernels as of October 30. Admins deciding when to patch production kernels can keep tabs on distro rollout status via daily.dev."}},{"@type":"Question","name":"How did an AI model discover and exploit the Linux kernel MPTCP vulnerability?","acceptedAnswer":{"@type":"Answer","text":"An unreleased Anthropic Claude research model built a zero-click exploit chain requiring no user interaction, going from an initial kernel memory leak to root-level command execution in about 53 minutes. It targeted Linux servers running MPTCP listeners, exploiting a race condition that frees a child socket's IP options while another CPU is still reading them during SYNACK construction, triggering a use-after-free. Developers gauging how AI changes vulnerability discovery can follow results like this on daily.dev."}}]} ```