Anthropic Says Unreleased Claude Built Root Exploit for Linux Kernel Flaw

An unreleased Claude model built a working root exploit for a critical Linux kernel bug, Anthropic says, and two of the Linux distributions that run much of the US server fleet still lack a fixed kernel. The flaw, tracked as CVE-2026-98432 and scored 9.8 on CVSS, can let a remote attacker run commands as root with no login and no user action. Anthropic's Frontier Red Team shared the finding on October 27. As of October 30, the gap between upstream fixes and enterprise packages was still open.

The upstream fix is not the problem. Stable kernels with the patch shipped on October 11 and October 15, according to Atlas. Debian, Oracle Linux and SUSE have shipped fixed kernels. Ubuntu has not, and Red Hat has deferred its fix for RHEL 8, 9 and 10 with no date.

What Anthropic says its model did

Anthropic's research post, as summarized by Cybersecurity News, describes a lab test rather than a real-world incident. After a first prompt from a researcher, Claude wrote an exploit that targets Linux servers with a multipath TCP (MPTCP) listener. Anthropic describes the root cause as a race condition that leads to a use-after-free in the kernel networking stack.

The trigger is a TCP connection request, known as a SYN packet, that carries an IPv4 Record Route or Timestamp option. Third-party analysis from GetRFF reports that the exploit needed about 48 minutes to get past KASLR, the kernel's address randomization, and about five more minutes to get a shell. That puts the total near 53 minutes. Anthropic has not published the exploit, so those timings cannot be checked independently.

No direct quotations from Anthropic appear in this story. The account rests on secondary coverage of the research post, and the full write-up was not available for verbatim quotation. Treat the timings as reported figures, not verified results.

Which servers are exposed, and why the MPTCP detail matters

The Linux kernel CVE team published the record on October 15, 2026. The fix was committed on October 6, according to Rescana. Every kernel from Linux 4.4 onward is affected until a fixed stable release is installed, per PatchMon.

The demonstration used MPTCP listeners, and that detail creates a trap. Administrators who do not run MPTCP may assume they are safe. Anthropic has not said whether servers without MPTCP can be rooted, and the bug is an IPv4 TCP handshake issue rather than a multipath-only one. Until a vendor or Anthropic says otherwise, treat any reachable TCP listener on an affected kernel as potentially exposed.

Rocky Linux and AlmaLinux rebuild from RHEL, so they carry the same Red Hat gap. Shops running those distributions should not expect a fix before Red Hat ships one.

Patch status for CVE-2026-98432 by distribution

Upstream stable releases with the fix include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The upstream commit, e3f33b0a1d89, was authored by Eric Dumazet and credits Anthropic researcher Xinyang Ge as the reporter, according to Penligent. Distribution kernels often backport fixes without changing the upstream version string, so administrators should confirm status with their vendor rather than compare version numbers alone.

Why the severity scores disagree

The kernel CNA and Ubuntu rate the flaw 9.8 under CVSS 3.1. Red Hat's rating varies across coverage. Panelica frames the gap as a 9.8 on Ubuntu but a 5.9 on Red Hat, while another source lists Red Hat's rating as 8.1 Important. The available sources do not explain the difference, so treat the discrepancy as unresolved.

Teams that triage by vendor severity could be tempted to push this down the list. That would be a mistake. A lower Red Hat score does not change the fact that the fix is missing, and Anthropic says a working exploit already exists in its lab.

What to do this week

• Inventory every Linux host and record its distribution and kernel version.
• Flag hosts that run TCP listeners reachable from the internet, then rank internal listeners reachable from less trusted network segments.
• Check each vendor's CVE page for CVE-2026-98432, starting with Ubuntu's tracker and Red Hat's entry.
• Install the fixed kernel as soon as your distribution ships it, then reboot. The new kernel does not run until the machine restarts.
• Test any temporary workaround before deploying it. A third-party nftables rule blocks the trigger until vendor kernels ship, but vendors have not verified it. Cyber Kendra reports that Red Hat says no available mitigation meets its standards for ease of deployment and stability.
• Monitor for unusual spikes in repeated SYN packets aimed at a single listener.

What to watch next

Ubuntu's CVE page is the most useful signal to follow. A change from work in progress to released would close the most visible gap in the current picture. A dated Red Hat fix would give administrators a planning window, and a Known Exploited Vulnerabilities listing from CISA would start a federal clock. CISA had not added the CVE to its catalog as of October 29.

The pattern is familiar. CISA added Fragnesia, tracked as CVE-2026-46300, to its catalog on October 28, with a federal deadline of October 31 and a requirement for forensic triage, according to HOL. Fragnesia was disclosed May 13, 2026, and its patch shipped the same day, but existing Dirty Frag patches did not cover it, per Tenable. This is the second privilege-escalation bug in the Linux kernel to land in a short window, and administrators are patching both at once.

The Ubuntu gap also resembles the one covered in Node2Shell's Brotli flaw story, where a KEV listing arrived while patches lagged. Federal deadlines are landing fast elsewhere too, as the Cisco firewall VPN zero-day shows with its November 1 date.

The next concrete test is whether Anthropic publishes its exploit. If it does, defenders will learn quickly whether servers without MPTCP are in reach, and that answer will shape how many administrators can wait for their vendor's kernel.