Anthropic exploit for Linux kernel flaw CVE-2026-98432 gives remote root on MPTCP servers

TLDR

• Anthropic says an unreleased Claude model wrote an exploit giving remote root on Linux servers with an MPTCP listener.¹²
• CVE-2026-98432 is a use-after-free in IPv4 TCP, rated CVSS 9.8, affecting kernels back to 4.4.²³
• Upstream and Debian fixes are out; BleepingComputer reports Ubuntu and RHEL kernels were still unpatched on 30 October.²⁸

Anthropic's Frontier Red Team says an unreleased internal Claude research model wrote an exploit that lets a remote attacker send packets to a Linux server with a multipath TCP (MPTCP) listener and run arbitrary commands as root, with no credentials or user interaction.¹ The underlying bug, CVE-2026-98432, is a race-condition use-after-free in the kernel networking stack, and in Anthropic's proof of concept it takes 48 minutes to leak a kernel pointer and another five minutes to reach shell command execution.¹ The exploit is one of five attack chains in an Anthropic post dated 27 October that also covers Chrome, Safari, Android and Windows.¹ BleepingComputer reports that the exploit bypassed kernel address space layout randomisation (KASLR).²

The Linux kernel CVE record, as reproduced by Debian's security tracker, says the flaw sits in tcp_v4_syn_recv_sock(), which hands connection options to the child socket without copying them, so a CPU handling a retransmitted SYN can read them after they are freed; the fix frees them after an RCU grace period.⁸ The record says IPv6 is not affected by the first issue.⁸ CSO Online says the flaw carries a critical score of 9.8, affects eight kernel branches dating back to version 4.4, and lists fixed releases 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7.³ heise reports the faulty code was committed in October 2015 and that Greg Kroah-Hartman confirmed the fix on 15 October.⁵ AlmaLinux credits Xinyang Ge with reporting the bug, Eric Dumazet with the upstream fix and Kuniyuki Iwashima with reviewing it.⁹

The sources differ on whether MPTCP is on by default.³⁶⁹ CSO Online says the protocol is opt-in and applications must request it explicitly.³ The Go security team says that since Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux, and LWN reports that the team's 29 October advisory warned that many systems may be unknowingly vulnerable.⁶⁴ AlmaLinux says it ships with MPTCP turned off, so applications cannot open MPTCP listeners unless an administrator enables it.⁹ The Go team adds that the bug is not specific to MPTCP and that systems without MPTCP listeners may be open to similar attacks.⁶ BleepingComputer says remote code execution has not been publicly demonstrated on servers without an MPTCP listener, and heise says it is unclear whether an MPTCP service must be running for an attack to work.²⁵ BleepingComputer cites CIQ as cautioning that disabling MPTCP alone is insufficient and recommending a temporary block on IPv4 TCP packets carrying IP options; AlmaLinux publishes an nftables rule for the same purpose and says neither step is a fix.²⁹

On patching, Debian lists fixed kernel packages 6.1.190-1 for bookworm and 6.12.113-1 for trixie.⁸ BleepingComputer reports that Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 remained vulnerable on 30 October with fixes in progress, that RHEL 8, 9 and 10 are affected with fixes planned, and that Oracle Linux, Amazon Linux and SUSE have released fixes for some kernel versions.² AlmaLinux says patched kernels for its releases are in testing ahead of a RHEL update.⁹ The sources differ on severity: BleepingComputer reports Red Hat scored the flaw 5.9 as a denial-of-service risk because exploitation is complex, whereas Red Hat's CVE page lists a CVSS 9.8 base score and rates it Critical for RHEL, noting that reliably executing arbitrary code requires precise heap control.²⁷ They also differ on timing: CSO Online puts the proof of concept at about 53 minutes from the initial memory leak to root, whereas Anthropic gives 48 minutes for the leak plus five for the shell command.³¹

On exploit availability, heise reports the only known exploit is Anthropic's and is not publicly available.⁵ BleepingComputer reports no confirmed exploitation in the wild, and heise says nothing is known about specific attacks.²⁵ Anthropic says it reported each vulnerability to the affected vendor under coordinated disclosure.¹

Why it matters: an unauthenticated remote kernel flaw with a worked root exploit was still unpatched in Ubuntu and RHEL on 30 October, and the Go security team says the bug is not specific to MPTCP, so the sources point to installing patched kernels rather than relying on disabling MPTCP.²³⁶