Anthropic AI model finds Linux kernel bug that leads to remote root access

Publisher excerpt From CSO Online

Linux servers running Multipath TCP (MPTCP) could be vulnerable to remote code execution through a flaw in the kernel’s networking stack. Anthropic has disclosed a zero-click exploit developed with an unreleased Claude research model that allows an unauthenticated attacker to execute arbitrary commands as root, without requiring any user interaction. Tracked as CVE-2026-98432, the vulnerability is a race-condition-induced use-after-free (UAF) bug in the Linux kernel. Anthropic demonstrated how an attacker could exploit the flaw remotely to leak kernel memory, defeat Kernel Address Space Layout Randomization (KASLR), hijack kernel control flow, and ultimately execute an attacker-controlled shell command. The research is part of Anthropic’s broader effort to evaluate AI models’ ability to discover and exploit vulnerabilities in widely deployed software. The company disclosed five exploit chains involving Chrome, Safari, Android, Windows, and Linux to demonstrate how its internal model could combine multiple weaknesses into functional attacks. Anthropic’s proof of concept for the Linux exploit took approximately 53 minutes to progress from the initial memory leak to successful root-level command execution, the company said in a blog post. A TCP connection race leaves kernel memory exposed According to a Linux kernel CVE advisory, the underlying flaw involves how Linux manages IP options during IPv4 TCP connection establishment. When a new connection is created, the kernel…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.