Anthropic's Claude AI found a critical Linux flaw that could give hackers root access

Anthropic says its unreleased Claude AI model uncovered a critical Linux kernel flaw and even demonstrated an exploit chain that could grant attackers root access. The vulnerability is tracked as CVE-2026-98432 and has a severity score of 9.8/10. The attack targets Linux servers with Multipath TCP (MPTCP) listeners, exploiting a “use-after-free” memory error in networking code. In Anthropic’s proof of concept, an attacker could leak kernel memory, bypass KASLR, hijack control flow, and execute arbitrary shell commands. The company estimates about 53 minutes from first memory leak to root-level access. The affected code spans eight Linux kernel branches dating back to version 4.4. Fixes are available in multiple kernel versions listed by Anthropic, but patch rollout may lag across distributions. Reportedly, Ubuntu and Red Hat Enterprise Linux hadn’t shipped fixes at the time of writing.