Anthropic's AI finds Linux flaw enabling root on MPTCP servers
The bug is rated 9.8 out of 10, and Ubuntu and Red Hat had not yet shipped patched kernels as of October 30.
31 Oct 2026 0 reads Compiled with AI
Anthropic's unreleased Claude model found a race-condition bug in Linux's IPv4 TCP stack that can be exploited without authentication to gain root on servers running Multipath TCP (MPTCP). The flaw, tracked as CVE-2026-98432, is a use-after-free caused by how the kernel transfers IP options from a pending connection to a new socket. The Linux kernel CVE advisory rates the vulnerability a critical 9.8 out of 10 and says it affects kernels from version 4.4 onward, including those used by Ubuntu, Red Hat Enterprise Linux and Rocky Linux.
The Bug Explained
In a proof-of-concept, Anthropic's model built an exploit in roughly 53 minutes. It leaked kernel memory, defeated Kernel Address Space Layout Randomization, hijacked kernel control flow and finally executed arbitrary commands as root. The attack is zero-click and needs no user interaction.
MPTCP is an opt-in feature that lets a single TCP connection use multiple network interfaces for higher throughput and resilience. It is not enabled by default in most applications, but recent releases of the Go programming language (1.24 and later) turn it on automatically for Linux listeners if the kernel supports it. Some Go-based services may run MPTCP without administrators noticing.
Patch Status
The fix is in the upstream Linux kernel and has been backported to maintained branches, but not every distribution has pushed an update. As of 30 October, Ubuntu 22.04, 24.04, 26.04 and 26.10 still ran vulnerable kernels, with fixes in progress. Red Hat Enterprise Linux 8, 9 and 10 had fixes planned for future updates. Debian, Oracle Linux, SUSE and Amazon Linux have released fixed kernels for some affected versions.
Administrators without patches can restrict access to trusted networks or IP addresses. CIQ, the Rocky Linux support provider, also recommends temporarily blocking IPv4 TCP packets that carry IP options, and says disabling MPTCP alone is not enough because ordinary TCP traffic can still trigger the bug. There are no confirmed reports of the flaw being exploited in the wild.