An AI found a serious Linux flaw and built a working attack

An unreleased Claude AI model from Anthropic found a serious flaw in the Linux kernel, then went a step further and built a working attack. The attack could give someone root access, the highest level of control on a Linux machine. It needs no clicks, no file opening and no password.

What was found

The flaw is tracked as CVE-2026-98432. It scores 9.8 out of 10 for severity, which is rated critical. The kernel is the core part of the Linux operating system, and the problem sits in its networking code. With root access, an attacker can run commands, change settings, read files and potentially take over the machine remotely.

How the attack works

The attack targets Linux servers that listen for Multipath TCP, or MPTCP. This feature lets a device use several network connections, such as Wi-Fi and mobile data, for one session.

The bug is a memory error called a use-after-free. The system tries to use a piece of memory after it has already been released. Here, one part of the kernel clears connection settings too early while another part is still reading them.

Anthropic showed how this mistake could be turned into full control. The steps included leaking kernel memory, getting around a protection called KASLR that hides where key code sits, and hijacking the kernel's control flow. The last step ran a command of the attacker's choice. The test attack took about 53 minutes from the first leak to root access.

Who it affects

Eight Linux kernel branches are affected, going back to version 4.4. Fixes exist in these kernel versions:

• 5.10.272, 5.15.223 and 6.1.190
• 6.6.159 and 6.12.113
• 6.18.56, 7.2.10 and 7.3-rc7

Many people get kernel updates through their Linux distribution, so fixes may not arrive everywhere at once. Debian, Oracle Linux, SUSE and Amazon Linux have patched packages for some releases. Ubuntu and Red Hat Enterprise Linux reportedly had not shipped fixes at the time of writing.

What to do

Administrators should check which kernel versions their servers run and install updates as they become available. They should also see whether any servers have MPTCP listeners turned on.

Business owners who rely on Linux servers can ask their IT provider two plain questions. Are the latest updates installed? Does any server use MPTCP? If a server runs Ubuntu or Red Hat, the answer may be that a fix is still pending.