Anthropic disclosed that its AI model, Claude, generated a functional exploit for CVE-2026-98432, a critical Linux vulnerability with a severity score of 9.8. The flaw, present since Linux version 4.4, allows remote attackers to gain root access without credentials by exploiting a race condition in memory handling. While the demonstrated attack leverages Multipath TCP (MPTCP), which is enabled by default in Go programs since version 1.24, security teams warn the underlying bug is not exclusive to MPTCP.
Red Hat released patches for RHEL 8, 9, and 10 on November 1, alongside fixes from Debian, SUSE, Oracle Linux, and Amazon Linux. However, Ubuntu’s security tracker continues to list versions 16.04 through 26.10 as vulnerable, with no release dates provided for fixes on older LTS releases like 16.04, 18.04, and 20.04. For systems unable to patch immediately, Red Hat issued a temporary firewall rule that reduces exposure but does not fully prevent exploitation.
The disclosure highlights a dual risk: the increasing capability of AI to identify and weaponize long-standing infrastructure flaws, and the fragmented response times among major Linux distributions. While Anthropic’s research demonstrates how AI can accelerate exploit development, the persistence of unpatched vulnerabilities in widely deployed Ubuntu versions creates a significant operational gap for administrators who rely on these stable releases.
Security teams must prioritize kernel upgrades over reliance on temporary mitigations, as the Go Security Team notes the vulnerability extends beyond the specific MPTCP feature used in the demo. The lack of clear timelines for Ubuntu’s legacy versions underscores the need for proactive migration strategies or compensating controls, such as strict network segmentation, until comprehensive patches are available.
