Claude-Built Linux Exploit Targets Bug That Ubuntu Still Hasn't Patched

What it is

CVE-2026-98432 is a race condition in the Linux kernel, present since version 4.4 and rated CVSS 9.8. Anthropic described a working remote root exploit for it in a research post on 27 October 2026 covering five targets: Chrome, Safari, Android, Windows and Linux. Anthropic says Claude wrote the Linux exploit after initial prompting, using an unreleased internal model. Decrypt's report does not say whether the exploit has been published.

How it works

One part of the kernel discards a piece of information while another part is still using it (a use-after-free style race, per AlmaLinux). A specially crafted message that opens an internet connection can trigger it. A lost race only fails the handshake and does not crash the system, so an attacker can retry indefinitely (Anthropic). The exploit takes under an hour to locate a hidden memory location, then about five minutes to run a command as root.

Preconditions / Affected

• Anthropic's exploit needs the target to expose a multipath TCP (MPTCP) listener.
• Go programs have enabled MPTCP by default since Go 1.24 (Go Security Team), so Go network services may expose it without anyone choosing to.
• The Go Security Team states the underlying bug is not specific to MPTCP. Not having an MPTCP listener does not make a host safe.
• Ubuntu's tracker lists every release from 16.04 to 26.10 as vulnerable.

What to do

The Go Security Team says the best fix is to upgrade to a patched kernel.

• Red Hat: fixes for RHEL 8, 9 and 10 shipped on 1 November 2026, including RHSA-2026:93412.
• Debian, SUSE, Oracle Linux and Amazon Linux have shipped fixes, at least for some versions.
• Ubuntu: fixes are in progress for 22.04, 24.04, 26.04 and 26.10. Versions 20.04, 18.04 and 16.04 show only "Vulnerable". The tracker gives no release date for any fix.
• Where patching is not yet possible, Red Hat has published a temporary firewall rule. The page does not reproduce the rule, so take it from the Red Hat security bulletin.

Caveats

Red Hat says its firewall rule "reduces exposure to this vulnerability but cannot fully prevent it". It says a full working solution is still under development. The exploit claims come from Anthropic, and the article reports no independent reproduction.