Anthropic AI model discovers remote root access bug in Linux kernel

AI-driven vulnerability discovery

Anthropic recently disclosed that one of its unreleased Claude research models successfully identified a significant security flaw in the Linux kernel. The company used the model to evaluate how AI can be used to find and exploit weaknesses in widely used software systems. This specific discovery involved a zero-click exploit, meaning an attacker can trigger the vulnerability without any action from the user.

The research was part of a broader effort to test the model's capabilities across various platforms. Anthropic demonstrated that its internal model could combine multiple separate weaknesses into a functional attack chain. They showcased similar exploit chains for other major systems, including Chrome, Safari, Android, and Windows.

The Linux exploit specifically targeted servers running Multipath TCP, or MPTCP. This protocol allows devices to use multiple network interfaces at once to improve bandwidth and provide failover if one path fails. Because MPTCP is an opt-in feature, the attack surface is limited to systems where administrators have specifically enabled it.

The mechanics of the kernel flaw

The vulnerability, tracked as CVE-2026-98432, is a use-after-free bug caused by a race condition in the networking stack. This occurs when the kernel manages IP options during the establishment of an IPv4 TCP connection. Specifically, the kernel can transfer ownership of these options from a pending request to a new socket without creating a separate copy of the data.

The problem arises when two different CPUs process information simultaneously. One CPU might be handling a retransmitted connection request while another uses those same options to build a synchronize-acknowledge response. If the first socket is deleted before the second CPU finishes reading the options, the kernel ends up accessing memory that has already been released. This creates a window for an attacker to interfere with the system's memory.

To fix this, the upstream solution involves changing how the kernel handles memory release. It now defers the deletion of these objects until a read-copy-update grace period has passed. This ensures that any concurrent readers have enough time to finish their tasks before the memory is wiped or reused by the system.

From memory leak to root access

Anthropic provided a proof of concept showing how an attacker could systematically break into a system. The process began with a memory leak, which allowed the attacker to bypass Kernel Address Space Layout Randomization. KASLR is a security feature that randomizes where parts of the kernel are located in memory to make exploitation harder.

Once the attacker could see the memory layout, they were able to hijack the kernel's control flow. This is the path the software takes to execute instructions. By taking control of this flow, the attacker could eventually execute arbitrary commands with root privileges. Root access is the highest level of permission on a Linux system, giving the attacker total control over the machine.

The speed of this process was notable for the research team. Anthropic reported that the exploit took about 53 minutes to move from the initial memory leak to a successful root-level command execution. This timeline shows how quickly a sophisticated chain of vulnerabilities can be turned into a functional tool for unauthorized access.

Impact and patch status

The vulnerability is considered highly severe, receiving a critical score of 9.8. It affects eight different Linux kernel branches, some of which date as far back as version 4.4. This wide range of versions means that many older systems may still be running vulnerable software that has not been updated in years.

Several major distributions have already released fixed kernel packages for their users. These include Debian, Oracle Linux, SUSE, and Amazon Linux. However, as of October 30, Ubuntu and Red Hat Enterprise Linux had not yet released patched kernels for the flaw. This delay means users on those platforms may still be at risk if they have not received updates.

Administrators are encouraged to check their current kernel versions against the list of fixed releases. They should specifically look for updates to versions 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. Systems that expose MPTCP listeners should be prioritized for these security updates.