CVE-2026-98432
CVSS 9.8 CRITICAL: in the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU… EPSS 0.5% (40th percentile). Microsoft patch: Release Notes.
Vulnerabilities & Exploits
Anthropic says its unreleased Claude model built a zero-click exploit for a Linux kernel flaw, progressing from an initial memory leak to root command execution in about 53 minutes. The Linux chain was one of five the company developed across Linux, Chrome, Safari, Android and Windows.
During IPv4 TCP connection setup on systems with Multipath TCP (MPTCP) enabled, two processor cores can access the same connection data at once. One can free the data while the other is still reading it, leaving a use-after-free flaw. Anthropic’s exploit uses that race to leak kernel memory, defeat Kernel Address Space Layout Randomization (KASLR), seize kernel control flow and run a command as root.
For operators with MPTCP enabled, a remotely reachable flaw can mean takeover of the host, not just a service crash. The reporting does not establish in-the-wild use, but the 53-minute chain shows why disclosure-to-fix time matters even to teams outside that footprint.
6 sources · 1 day ago
CVSS 9.8 CRITICAL: in the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU… EPSS 0.5% (40th percentile). Microsoft patch: Release Notes.
BleepingComputer
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners.
originalSecurityWeek
In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware.
originalCSO Online
Anthropic AI model finds Linux kernel bug that leads to remote root access
Anthropic’s unreleased Claude model developed a zero-click exploit for a Linux kernel flaw that allowed remote attackers to execute commands with root privileges.
originalPart of the PlainSec briefing for 2026-10-31
Every edition of this story: Claude built a Linux exploit for zero-click remote root