--- title: "Claude Code Found a Linux Vulnerability Hidden for 23 Years" url: https://daily.dev/posts/claude-code-found-a-linux-vulnerability-hidden-for-23-years-ty1tp2xrp source_url: https://mtlynch.io/claude-code-found-linux-vulnerability/ type: article source: "Michael Lynch" published: 2026-04-03T15:18:29.484Z updated: 2026-04-03T15:18:53.706Z tags: ["security", "linux", "claude-code"] reading_time: 7 upvotes: 14 comments: 1 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Claude Code Found a Linux Vulnerability Hidden for 23 Years **[Michael Lynch](https://daily.dev/sources/mtlynch)** · 7 min read · 14 upvotes · 1 comments ## Summary Nicholas Carlini, a research scientist at Anthropic, used Claude Code to discover multiple remotely exploitable heap buffer overflows in the Linux kernel, including one that had gone undetected for 23 years. The vulnerability exists in the NFS driver: when a lock request is denied, the server writes a response of up to 1056 bytes into a 112-byte buffer, allowing an attacker to overwrite kernel memory. The discovery required minimal human oversight — a simple shell script looped Claude Code over every source file in the kernel asking it to find vulnerabilities. Carlini has found hundreds more potential bugs but lacks the time to validate and report them all. The rapid improvement of LLMs at vulnerability discovery signals a coming wave of security bug disclosures. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@tariquenfaraz** · 4 upvotes > are you sure about that ? AI has a tendency to Hallucinate. so many bugs that he couldn't report all ? I don't know all of them are bugs. ## Similar posts on daily.dev - [Claude Code Used to Find Remotely Exploitable Linux Kernel Vulnerability Hidden for 23 Years](https://daily.dev/posts/claude-code-used-to-find-remotely-exploitable-linux-kernel-vulnerability-hidden-for-23-years-vni2dtvdh) · InfoQ · 0 upvotes · 0 comments - [Flaws in Claude Code Put Developers' Machines at Risk](https://daily.dev/posts/flaws-in-claude-code-put-developers-machines-at-risk-pkmhpix9s) · Dark Reading · 0 upvotes · 0 comments - [Claude Code is still vulnerable to an attack Anthropic has already fixed](https://daily.dev/posts/claude-code-is-still-vulnerable-to-an-attack-anthropic-has-already-fixed-z6t1eqrrv) · InfoWorld · 1 upvotes · 0 comments - [Vim and GNU Emacs: Claude Code helpfully found zero-day exploits for both](https://daily.dev/posts/vim-and-gnu-emacs-claude-code-helpfully-found-zero-day-exploits-for-both-zduubrik1) · InfoWorld · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/claude-code-found-a-linux-vulnerability-hidden-for-23-years-ty1tp2xrp)