Anthropic AI model finds Linux kernel bug that leads to remote root access
Summary
Anthropic has disclosed a zero-click exploit developed with an unreleased Claude research model that allows an unauthenticated attacker to gain remote root access on Linux servers running Multipath TCP. The vulnerability, tracked as CVE-2026-98432, is a race-condition-induced use-after-free bug in the kernel's networking stack that can lead to kernel memory leaks and control flow hijacking.
IFF Assessment
This article details a newly discovered critical vulnerability in the Linux kernel that allows for remote root access, posing a significant threat to servers.
Severity
Defender Context
This vulnerability highlights the ongoing risks associated with complex kernel functionalities like Multipath TCP and the increasing sophistication of AI-assisted vulnerability discovery. Defenders should prioritize patching affected Linux systems and monitor for any signs of exploitation, especially given the zero-click nature of this exploit.