Science & Tech · Cybersecurity · 2 hrs ago
Linux kernel flaw enables remote root access on some servers
A Linux kernel flaw can let attackers run commands as root on affected servers, giving them the highest level of control.
The bug, CVE-2026-98432, is in the code that handles IPv4 TCP connections and can make the kernel use memory after it has been freed.
Anthropic said its AI model Claude wrote an exploit that worked in a research environment against servers listening for Multipath TCP, a feature that can use several network paths for one connection.
The flaw is rated 9.8 out of 10 by the Linux kernel CVE team, but the demonstration does not show that every Linux server can be attacked in the same way.
The upstream Linux kernel has been fixed, but package updates vary by distribution; reports say Debian, Oracle Linux, SUSE and Amazon Linux have shipped fixes for some systems, while Ubuntu and Red Hat had not released fixes as of October 29.
Administrators should check their specific kernel package and install its vendor's update when available; the sources give no release date for pending Ubuntu or Red Hat fixes.
A Linux kernel flaw, CVE-2026-98432, can allow remote attackers to run commands as root on some servers under specific conditions.
Anthropic said on October 27 that it used AI-written exploit code to demonstrate the attack against Linux servers with an MPTCP listener.
The flaw is a use-after-free bug in IPv4 TCP connection handling and has a CVSS score of 9.8 from the Linux kernel CVE team.
The upstream Linux kernel has been patched, but Ubuntu and Red Hat had not released fixed kernels as of October 29.
Some other distributions, including Debian, Oracle Linux, SUSE and Amazon Linux, had released fixes for at least some kernels.
- Who
- Anthropic demonstrated the exploit; Linux server operators using affected kernels may be at risk.
- What
- CVE-2026-98432 is a Linux kernel flaw that can enable unauthenticated remote root command execution on some servers.
- When
- The CVE was disclosed on October 15, and Anthropic announced its demonstration on October 27, 2026.
- Where
- Linux servers with an MPTCP listener are the demonstrated target; the flaw affects multiple Linux distributions.
- Why
- A race condition in IPv4 TCP connection handling can cause the kernel to read memory that has already been freed.
This story does not have two clearly opposing sides.
Kernel developers applied a fix, according to The Hacker News.
The Linux kernel CVE team disclosed CVE-2026-98432.
Anthropic said it had demonstrated remote root command execution using the flaw.
Ubuntu and RHEL had not released fixed kernels, according to The Hacker News.
- CVE
- CVE-2026-98432
- CVSS score
- 9.8 out of 10, rated by the Linux kernel CVE team
- Vulnerability type
- Use-after-free caused by a race in IPv4 TCP connection handling
- Demonstrated target
- Linux server with an MPTCP listener
- Ubuntu and RHEL status
- No fixed kernel released as of October 29, 2026
- Upstream fix
- Applied on October 5, 2026, according to The Hacker News
4 sources
What people are saying
was patched upstream and backported to all maintained stable kernel branches