Anthropic AI model finds Linux kernel bug granting remote root access

An unreleased Claude research model discovered a zero-click vulnerability in the Linux kernel, tracked as CVE-2026-98432, that allows unauthenticated attackers to execute commands as root.^[1][3]

The discovery demonstrates the ability of AI to automate the identification and chaining of complex software flaws ^[1]. Anthropic says, "These attack chains demonstrate the model’s ability to create sophisticated, multi-step exploits in both open-source and proprietary software" ^[7].

Root access via MPTCP flaw

The vulnerability, tracked as CVE-2026-98432, affects Linux servers running Multipath TCP (MPTCP), a protocol that allows a device to use multiple network interfaces simultaneously for better bandwidth and failover ^[1]. The flaw is a race-condition-induced use-after-free bug located in the kernel's networking stack ^[1].

According to a Linux kernel CVE advisory, the bug occurs during IPv4 TCP connection establishment when the kernel manages IP options ^[1]. If a child socket is freed while another CPU is still processing a retransmitted connection request, the kernel reads memory that has already been released ^[1].

Anthropic's proof of concept demonstrated that an attacker could leak kernel memory and defeat Kernel Address Space Layout Randomization (KASLR), a feature that prevents attackers from predicting the location of kernel code in memory ^[1]. The company reported that the model progressed from the initial memory leak to successful root-level command execution in approximately 53 minutes ^[1].

The flaw received a critical severity score of 9.8 ^[1][3]. It affects eight Linux kernel branches dating back to version 4.4 ^[1]. While patched kernels are available for Debian, Oracle Linux, SUSE, and Amazon Linux, Ubuntu and Red Hat Enterprise Linux had not released patches as of October 30 ^[1].

AI-driven exploit chains

The Linux discovery was part of a broader research effort by Anthropic to evaluate AI's ability to find vulnerabilities in widely deployed software ^[1]. The company disclosed five exploit chains developed by the unreleased model targeting Chrome, Safari, Android, Windows, and Linux ^[1][7].

In the case of Chrome, Anthropic reported that the model wrote a chain that allowed arbitrary code execution outside the browser's sandbox ^[7]. This research led to 62 patched CVEs in Chrome 156, including 13 sandbox escapes ^[7].

The model also developed a data-only attack against Safari that bypassed the same-origin policy, allowing JavaScript to access a user's history and cookies ^[7]. For Android, the model combined source code analysis and reverse engineering of Google Play services to extract personal information from a stolen phone without unlocking it ^[7].

Ivanti root access exploits

While AI research reveals new risks, other threat actors are currently exploiting chained vulnerabilities in production environments. On October 30, CISA added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities catalog ^[13].

Security researchers at Volexity tracked a threat actor, UTA0576, using a zero-day exploit chain to compromise fully patched Ivanti appliances starting October 3 ^[5][6]. The attack began with an authentication bypass in the public login script, followed by a file write vulnerability in an upload handler that allowed the execution of a Perl script ^[5][6].

The final stage involved privilege escalation via the dsinvoked service, which granted the attacker root access ^[5][6]. Volexity noted that the attacker used memory-only changes and restored configuration data to hide its activity ^[5]. This method bypassed Ivanti's official Integrity Checker Tool ^[5][9].

The attacker used the access to extract domain credentials and query Active Directory for BitLocker recovery keys and administrator passwords ^[5][6]. Regarding the attacker's goal, Volexity stated, "Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined" ^[9].

What we don't know

• When Ubuntu and Red Hat will release their patched kernels for CVE-2026-98432.
• The specific identity or nationality of the threat actor UTA0576.
• The specific technical details of the Windows HTTP/3 remote crash exploit discovered by Claude.