Ubuntu and Red Hat Enterprise Linux users were still awaiting distribution fixes on October 29 for CVE-2026-98432, a Linux kernel networking flaw that Anthropic says it exploited to run commands remotely as root. The company’s demonstration targeted servers with a multipath TCP listener; it does not establish that the same takeover works against servers without one.
The vulnerability has been fixed upstream, but availability through distribution packages varies. Ubuntu lists affected kernels as vulnerable or under development, while The Hacker News reports that fixes for RHEL 8, 9 and 10 and OpenShift 4 remain deferred. SUSE’s advisory lists released fixes for several enterprise products.
What the exploit claim establishes
In an October 27 disclosure, Anthropic said Claude wrote the Linux exploit after initial prompting. According to the company, an attacker could send packets to a server with a multipath TCP listener and execute an arbitrary shell command as root without credentials or user interaction.
Multipath TCP, or MPTCP, lets a connection use multiple network paths. Linux applications must explicitly request it when opening a socket, according to The Hacker News. The connection between MPTCP and this exploit comes from Anthropic’s account; the kernel fix and CVE description do not identify it as a prerequisite for the underlying flaw.
Anthropic described two exploitation stages. First, the bug causes the kernel to return extra memory contents. A reply containing a kernel pointer reveals the memory layout, defeating kernel address space layout randomization, or KASLR. The second stage uses the same flaw to overflow a buffer and replace a callback pointer, redirecting execution to a payload already placed in kernel memory.
The company said an unsuccessful attempt only failed the connection handshake, allowing repeated attempts without crashing the server. Its proof of concept took 48 minutes to leak a kernel pointer and another five minutes to execute a shell command. The post does not provide exploit code, the tested kernel version or its configuration, limiting what readers can conclude about other deployments.
A race during connection handling
The Ubuntu advisory for CVE-2026-98432 describes a timing error in which one CPU can free IPv4 socket options while another still reads them during TCP connection handling. Reading that released memory creates a use-after-free condition. A related problem occurs during request-socket migration.
The fix delays freeing the options until concurrent readers have finished. IPv6 is unaffected by the first issue because its connection-handling code copies the options. The advisory separately identifies an IPv6 migration issue involving options set by CALIPSO, to be addressed in another patch; it does not give IPv6 a blanket exemption from related problems.
The Hacker News reports that the bug dates to Linux 4.4 and that developers applied the fix on October 5. The CVE was published on October 15, before Anthropic disclosed its exploit claim.
Severity assessments differ. The kernel CVE team assigns 9.8 out of 10, treating attack complexity as low. Red Hat’s advisory gives a preliminary score of 8.1, with high attack complexity—the same distinction reflected in SUSE’s 8.1 assessment. Red Hat describes system crashes as the primary consequence, alongside potential memory corruption.
Which fixes are available
Ubuntu’s advisory, last updated October 28, lists its main kernels for 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as vulnerable with fixes in progress. Its main kernels for 16.04, 18.04 and 20.04 are also vulnerable. Listed cloud, FIPS and real-time kernel variants have their own pending statuses; the proposed versions marked “work in progress” are not released fixes.
SUSE’s released-package list identifies these fixed minimum versions for kernel-default:
- SLES 15 SP4-LTSS and SUSE Linux Enterprise Micro 5.3 and 5.4:
5.14.21-150400.24.246.1. - SLES 15 SP5-LTSS and SUSE Linux Enterprise Micro 5.5:
5.14.21-150500.55.195.1. - SLES 15 SP6-LTSS:
6.4.0-150600.23.143.1. - SLES 16.0:
6.12.0-160000.40.1.
For real-time kernels, SUSE separately lists kernel-rt fixes at 5.14.21-150400.15.192.2 for Micro 5.4 and 5.14.21-150500.13.167.2 for Micro 5.5. These package-specific releases matter even though SUSE’s overall CVE status remains “Pending.”
For other distributions, The Hacker News reports fixes in Debian trixie’s linux 6.12.113-1, Debian 12’s linux 6.1.190-1 and linux-6.12 6.12.113-1~deb12u1, and Oracle Linux 7–10’s UEK advisories ELSA-2026-500397, ELSA-2026-500398 and ELSA-2026-500399. It also identifies Amazon Linux 2023 fixes for kernel6.18 at 6.18.56-125.164.amzn2023 and kernel6.12 at 6.12.113-138.209.amzn2023; these do not cover every Amazon Linux kernel package.
Red Hat says no available mitigation meets its deployment, applicability and stability criteria. The evidence does not establish that disabling MPTCP or filtering connection requests carrying IP options would mitigate the flaw. As of October 29, The Hacker News reported no attacks using it in the vendor advisories, CVE record or Anthropic post—a distinction from the company’s claimed proof of concept.
