Anthropic’s unreleased Claude AI model has uncovered a critical Linux kernel flaw.And it didn’t just stop at spotting it; it built an attack that could give someone root access, the highest level of control on Linux.The attacker can run commands, change settings, access files, and potentially take over the machine remotely.
No clicks, file opening, or password needed.The flaw is tracked as CVE-2026-98432 and scores a critical 9.8 out of 10 in severity.Add How-To Geek on Google Add as Preferred Source Follow on Google Discover This Linux kernel flaw is a bigger deal than it sounds A memory error becomes a working exploit The Linux kernel is the core part of the operating system.
The vulnerability affects its networking code.The attack targets Linux servers listening for Multipath TCP or MPTCP, which lets a device use multiple network connections like Wi-Fi and mobile data for one session.The bug is a memory handling error called a “use-after-free” that tries to use memory after it’s been released.
When a new connection is set up, Linux passes some connection settings to a fresh socket.Another CPU core might be using the same settings to answer a repeated request.However, if the first side clears them away too early, the second reads memory that’s already gone.
An attacker can exploit this mistake to interfere with the kernel.Anthropic showed how this could happen with steps involving leaking kernel memory, bypassing KASLR (a protection that hides where key code sits), hijacking the kernel’s control flow, and finally running a shell command of their choice.The company’s proof-of-concept attack took about 53 minutes to go from the first leak to root-level access.
Eight Linux kernel branches are affected by the vulnerability, that go back to version 4.4.The flaw has been fixed in kernel versions 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7.However, patches may not arrive everywhere at once—especially for users who receive kernel updates through their Linux distributions.
Debian, Oracle Linux, SUSE, and Amazon Linux have patched packages for some releases.Ubuntu and Red Hat Enterprise Linux haven’t reportedly shipped fixes at the time of writing this.Administrators should check their Linux kernel versions, install updates when available, and see whether their servers have MPTCP listeners enabled.
Related Linux faces its largest security threat in years—here's how to deal with Copy Fail Most distros are vulnerable without patches.Posts 16 By Jon Fingas Source: CSO
Read More
