On October 27, Anthropic reported that an internal research model, after an initial prompt, wrote a Linux kernel exploit that gives a remote, unauthenticated attacker a root shell. The flaw is CVE-2026-98432, and what makes it a good case study is that the same vulnerability gets scores between 5.9 and 9.8 depending on who rates it.
What CVE-2026-98432 Is and How It Works
It's a race condition in TCP connection establishment over IPv4. According to The Hacker News, when the child socket is created, the tcp_v4_syn_recv_sock() function takes the IP options from the pending request socket without copying them. If the child is freed while another CPU is still building a SYNACK for a retransmitted SYN, the kernel reads memory that has already been freed: a use-after-free. IPv6 isn't affected because it does copy the options. The fix, per the description Tenable picks up, uses kfree_rcu() to wait for other CPUs to finish reading before freeing.
The Hacker News states the flaw dates back to Linux 4.4 and that the fix commit was applied on October 5; we couldn't confirm either of those in a second source, so treat them as single-source. Tenable lists the CVE's publication on October 15.
What Anthropic Says (and What It Doesn't)
In its October 27 post, Anthropic's Frontier Red Team writes that, after an initial prompt, Claude produced an exploit that lets a remote attacker send packets to Linux servers with a multipath TCP (MPTCP) listener and run arbitrary commands as root, with no credentials or user interaction. It cites timings: 48 minutes to leak a kernel pointer and another five to reach command execution. It says the patch is upstream and backported to all maintained stable branches.
Why the Scores Differ So Much
The key difference is attack complexity: the kernel team assumes AC:L (low) and Red Hat AC:H (high), because the timing race isn't won every time. Red Hat calls its figures preliminary, and its page has changed since THN cited it. The operational moral: a score is an opinion about how hard exploitation is, not about whether an exploit exists; and here Anthropic says a working one does.
What to Do
- Install the fixed kernel. According to THN, the fix is in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3; Debian, Oracle Linux, Amazon Linux 2023 and SUSE already had builds, while Ubuntu and RHEL 8/9/10 still had no fixed kernel as of October 29 (check the current status on each distribution).
- Red Hat says no mitigation exists that meets its criteria. The Go team, on oss-security (October 29), recommends updating the kernel and notes that Go 1.24+ enables MPTCP by default on listening sockets; it offers
GODEBUG=multipathtcp=0as a stopgap, but warns that the bug isn't exclusive to MPTCP and systems without MPTCP listeners could be vulnerable to similar attacks. - Prioritize internet-facing servers: load balancers, proxies and GPU inference hosts.