An AI wrote a remote root exploit for Linux. The patch was public for weeks, but most servers couldn't get it

Update, November 5, 2026: Ubuntu has published test kernels with the fix for 22.04, 24.04 and 26.04 in its "-proposed" pocket (November 2), but its CVE page still lists no released fix; 20.04, 18.04 and 16.04 remain vulnerable, with fixes pending. SUSE shipped a fixed kernel for SLES 15 SP7 on November 4 (SUSE-SU-2026:5091-1). Ubuntu says that "no other exploit is known to have been generated or published", and CVE-2026-98432 is still not in CISA's KEV catalogue (version dated November 4).

Anthropic says an unreleased Claude research model wrote a zero-click exploit that gives a remote attacker root on Linux servers, using a race-condition bug in the kernel's TCP connection code (CVE-2026-98432, CVSS 9.8). The upstream fix landed in early October, but when Anthropic published on October 27 the biggest enterprise distributions had not shipped it: Red Hat did so on November 1, and Ubuntu's fixed kernels were still in testing on November 5. The story is less "AI finds a kernel bug" than what happens when exploit-writing gets faster and patch delivery does not.

The short version

Linux fixes reach most servers in two steps. Kernel developers fix the source code and backport it to the maintained "stable" branches. Then each distribution (Red Hat, Ubuntu, Debian, SUSE, Amazon Linux and the rest) builds, tests and ships its own kernel package. Admins only get the fix after the second step, and a reboot.

CVE-2026-98432 is a use-after-free in the code that handles incoming TCP connection requests: under a precise timing race, the kernel uses memory it has already freed. It has been present since Linux 4.4, released in 2016. On October 27, Anthropic's Frontier Red Team wrote that, "after initial prompting", Claude built an exploit that lets "a remote attacker to send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or user interaction." In Anthropic's proof of concept, the whole chain took about 53 minutes.

The upstream fix was already out. The distribution kernels that most companies run were not. Anthropic has not published the exploit, nobody has reported attacks, and the bug is not in CISA's Known Exploited Vulnerabilities (KEV) catalogue. But the gap between "fixed upstream" and "fixed on my server" is now the part to watch.

Timeline

January 2016: Linux 4.4 ships with the code that introduced the bug (commit 079096f103fa, per the CVE record and the CSA research note).
September 25, 2026: CVE-2026-98432 is reserved by the Linux kernel CVE team.
October 5: the upstream fix (commit e3f33b0a1d89, by Eric Dumazet, reviewed by Kuniyuki Iwashima) is applied, according to the CSA note and AlmaLinux.
October 15: the CVE record is published.
October 16–22: Oracle's UEK kernels and Debian 12/13 ship fixes (per TuxCare and the Debian tracker).
October 24: the kernel CVE team scores it CVSS 9.8, per the CSA note; Amazon Linux 2023 fixes its 6.18 kernel.
October 27: Anthropic publishes "Discovering and exploiting vulnerabilities in critical, real-world software with Claude", describing the Linux exploit alongside chains in Chrome, Safari, Android and Windows.
October 29: the Go Security Team warns that Go programs enable multipath TCP on listening sockets by default. Red Hat raises its rating from Moderate (5.9) to Important (8.1), per TuxCare. SUSE ships fixes for SLES 15 SP6 LTSS and SLE Micro 5.3–5.5.
October 30: Red Hat publishes bulletin RHSB-2026-016 rating the flaw Critical, with an interim firewall mitigation and no fixed kernels yet. AlmaLinux puts patched kernels in testing. Anthropic's post is marked as modified on this date (the change is not described).
November 1: Red Hat ships fixed RHEL kernels, e.g. RHSA-2026:93412 for RHEL 9.
November 2: AlmaLinux moves the fix to production. Ubuntu puts fixed kernels for 22.04, 24.04 and 26.04 in its -proposed testing pocket. Hosting platform Northflank, recovering from its October 30 breach, says in a status update that it has patched CVE-2026-98432 across its fleet.
November 4: SUSE ships a fixed kernel for SLES 15 SP7.
November 5: Ubuntu's CVE page still shows every supported release as work in progress and 16.04, 18.04 and 20.04 as vulnerable.

What we know

The bug. According to the CVE record, it is a use-after-free in IPv4 TCP: IP option data attached to a connection request is freed too early, so a race between a retransmitted connection request (SYN) and the teardown of the new socket can touch freed memory. The fix delays freeing that data until it is safe (after a "read-copy-update grace period", the kernel's mechanism for delayed freeing). The record lists fixed stable releases including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. A similar problem exists when TCP request-socket migration (net.ipv4.tcp_migrate_req) is enabled, which is off by default. IPv6 is not affected by the main issue.

Anthropic's claims. The post attributes the work to "an unreleased, internal research model" used "over the past few months." For Linux, it says the exploit works in two stages: it first defeats KASLR (kernel address randomisation) remotely by making the kernel send back extra memory that contains a kernel pointer, then reuses the same bug to overwrite a callback pointer and run "an attacker-chosen shell command running as root." Anthropic highlights one property: "a lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed." Its proof of concept took "48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution." AlmaLinux credits Anthropic researcher Xinyang Ge with the report.

The same post claims a one-click Chrome chain ("62 CVEs have been assigned and patched as of Chrome 156"), a Safari chain fixed by Apple, an Android lock-screen bypass fixed by Google, and a Windows QUIC remote crash fixed as CVE-2026-33096. Anthropic says it reports under a policy that "gives developers 90 days to patch and a further 45 days before we discuss details beyond what is already included in a public advisory."

Who is exposed. Red Hat says exploitation "requires precise timing of network requests but does not require any privileges or user interaction," and that systems accepting inbound TCP connections are most exposed. Anthropic's chain needs a multipath TCP (MPTCP) listener, a TCP extension that lets one connection use several network paths. That sounds niche, but the Go Security Team notes that since Go 1.24, Go programs on Linux enable MPTCP on listening sockets by default, and that the bug "is not specific to MPTCP." Ubuntu's security team also says the vulnerability is not specific to MPTCP. TuxCare reports that RHEL and its rebuilds ship with MPTCP disabled, while the upstream default is enabled.

Severity disagreement. The kernel CVE team, Ubuntu and now Red Hat score 9.8. TuxCare reports that Oracle, SUSE and Amazon use 8.1, rating attack complexity high instead of low; SUSE's own CVE page confirms 8.1 and rates the issue Important. NVD had not scored it.

Patch status, as of November 5. Fixed: Debian 12 and 13, Oracle UEK, SUSE's 16.0 and several 15 releases (including SLES 15 SP7 on November 4), some Amazon Linux 2023 kernels, RHEL 8/9/10 (November 1) and AlmaLinux (November 2). Not yet released: all Ubuntu releases. Ubuntu's fixes for 22.04, 24.04 and 26.04 are in testing, and Ubuntu says they will move to the normal updates pocket "as soon as those tests are complete", without giving a date; 20.04 and older, which need Ubuntu Pro, have fixes pending. Per TuxCare, Amazon Linux 2 was pending as of October 30; Rescana reported RHEL 9 real-time kernels and OpenShift's RHEL CoreOS still without a fix on November 2.

Not observed. No source we read reports exploitation in the wild, and CVE-2026-98432 was not in CISA's KEV catalogue (version dated November 4) when we checked on November 5. Anthropic has not published its exploit, kernel version or test configuration, and TuxCare and the CSA note found no independent reproduction. Ubuntu wrote on November 2 that "no other exploit is known to have been generated or published."

Technical analysis

Why this bug is dangerous. Most kernel bugs AI tools have surfaced this year, including the Vghost flaw we covered on October 14, need local access or a malicious virtual machine. This one sits in the code path that every TCP listener runs before an application sees a single byte. There is no login, no user click, and the target does not need to run anything unusual beyond, for Anthropic's chain, an MPTCP-enabled listener. The retry property matters as much as the bug: a race that fails silently, without crashing the box, turns a fragile exploit into one an attacker can simply leave running. That is why Red Hat moved from 5.9 to Critical within days: the "high complexity" of winning a race means little if losing costs nothing.

Why the controls lagged. Nothing in the upstream process failed. The fix was small, reviewed and backported. What lagged was the distribution layer, which most companies' patch processes rely on. Three things slowed it down:

The CVE looked ordinary at first. The Linux CNA publishes a very large number of CVEs, most of them low-impact. Red Hat first rated this one Moderate. Many organisations prioritise by vendor severity, so a bug labelled Moderate on October 15 would not have been rushed.
The exploitability proof came late and second-hand. The severity changes followed Anthropic's October 27 post, the Go advisory and the Red Hat bulletin, not the original record. Defenders learned it was a remote root bug from a lab's blog post, not from their vendor.
Configuration hid the exposure. "Needs an MPTCP listener" reads like a niche condition until you know that a common language runtime turns MPTCP on by default. A team that checked its sysctl but not its Go services could easily conclude it was safe.

Our assessment: this is the pattern AI-assisted vulnerability research is likely to produce more often. Discovery and exploit writing get faster and cheaper. The unit of time that does not shrink is a distribution's build-test-ship cycle followed by an organisation's reboot window. Ubuntu's own explanation makes the point: its kernels are tested on more than 2,000 certified servers and devices before release. Anthropic followed a coordinated process with the kernel developers, and the fix was upstream before the post. Still, the post describes the exploit's stages in some detail 22 days after the upstream fix, at a moment when RHEL and Ubuntu users had no package to install. Anthropic's policy speaks of 45 days "before we discuss details beyond what is already included in a public advisory"; whether a stage-by-stage description counts as such detail is a fair question for any lab publishing exploit results. Disclosure policies were written around the vendor's patch. For Linux, the "vendor" that ships to most servers is the distribution.

What is novel about the AI angle. Vulnerability finding by AI is no longer news; the step change is exploitation. Anthropic says that "after initial prompting" the model produced a working remote chain: an information leak to defeat KASLR, then control-flow hijack. Remote kernel exploits are rare, and historically a scarce, expensive skill. If the claim holds up, the cost of turning a published kernel fix into a working exploit is falling. That is the threat model defenders should plan for, whether or not anyone has used this particular bug.

The Northflank footnote. Northflank, one of the AI developer platforms hit in what Wiz calls "Black October", listed this CVE among the fixes it rolled out after its October 30 breach. It has not said the bug played any role in the intrusion, and its root-cause analysis is still pending. We mention it only because it shows the kind of operator that rushed this patch: a multi-tenant platform with internet-facing Linux hosts.

What remains unclear

How much the model did on its own. "After initial prompting" is not quantified. Anthropic does not say whether the model found the bug independently or was pointed at the area, nor how many attempts, how much compute or how much human review were involved.
Which model. The post names no model. It promotes access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 through its Cyber Verification Program, but does not say whether any of them can do the same, or whether the internal model will be released and with which safeguards.
Exactly what is required. Anthropic's exploit needs an MPTCP listener. The CVE record, AlmaLinux, Go and Ubuntu say the underlying bug is broader. AlmaLinux says the trigger is a SYN carrying IPv4 options; Red Hat's bulletin does not confirm that as a prerequisite. Whether plain TCP listeners can be exploited with a comparable chain is unanswered.
The dates in the middle. When Anthropic reported the bug, and whether distributions were briefed under embargo before the October 15 CVE, is not stated by Anthropic or the distributions we read.
What changed on October 30. Anthropic's post shows a modification date three days after publication, with no change note.
When Ubuntu ships. Ubuntu gives no date for moving its tested kernels to the updates pocket.
Severity. NVD has not scored the CVE; vendors range from 8.1 to 9.8.
The other claims. We have not verified the Chrome, Safari, Android and Windows findings with Google, Apple or Microsoft.

Lessons and what to do

For security and operations teams

Patch now and reboot. On RHEL and rebuilds, Debian, SUSE, Oracle UEK and patched Amazon Linux kernels, fixed packages exist. Install and reboot; a kernel fix does nothing until the new kernel is running.
On Ubuntu 22.04, 24.04 and 26.04, watch for the kernel to move from -proposed to the normal updates pocket and install it as soon as it does. Ubuntu explains how to test the -proposed kernels in its blog post; they are not installed automatically.
If you run Ubuntu, older LTS releases, OpenShift/RHEL CoreOS or another not-yet-fixed kernel, use the interim mitigations from your vendor. Red Hat and AlmaLinux describe an nftables rule that drops incoming IPv4 TCP packets carrying IP options. Red Hat warns it "can't fully prevent exploitation" and may break some workloads, and AlmaLinux notes that container-to-container traffic on the same host may bypass it. Disabling MPTCP (net.mptcp.enabled=0) removes the setup in Anthropic's exploit, not the bug. Ubuntu's security team says it "believes that security updates are the only appropriate mitigation."
Find your MPTCP listeners. ss -lnMp (or ss -H -lMn) lists them. Check Go services specifically: anything built with Go 1.24 or later may listen with MPTCP unless GODEBUG=multipathtcp=0 is set. The Go team itself calls per-program opt-outs "fragile".
Don't let vendor severity alone set your patch order. This CVE moved from Moderate to Critical in two weeks. Track exploitability signals too: a lab writing a working exploit, a language-runtime advisory, a vendor bulletin.
Watch for a public exploit or a KEV listing. Either should trigger emergency patching for any internet-facing host still unpatched.

For AI builders and research labs

When you publish exploit results for widely deployed open-source components, time the details to downstream availability, not just the upstream commit. For Linux, that means checking whether the major enterprise distributions have shipped.
Say plainly how much human help there was and what the model was given. "After initial prompting" leaves defenders unable to judge how repeatable the result is for attackers with weaker models.

For leadership

Ask how long it takes your organisation, from vendor package to running kernel, to patch an internet-facing remote root bug. For many fleets the answer is a monthly window. AI-assisted exploit development is compressing the attacker's side of that race.
Budget for faster kernel patching (live patching, rolling reboots, immutable images) rather than treating it as routine maintenance.

Sources

Primary:

Coverage:

An AI wrote a remote root exploit for Linux. The patch was public for weeks, but most servers couldn't get it

The short version

Timeline

What we know

Technical analysis

What remains unclear

Lessons and what to do

Sources

AI coding agents keep installing archived MCP servers that will never get security fixes

AI-found PHP2Shell flaws are under active attack, CISA says — and now chained to root firewalls

OpenSSH 10.6p2 fixes a no-password login on Alpine and other musl systems — and speeds up releases, citing AI bug-hunting

The short version

Timeline

What we know

Technical analysis

What remains unclear

Lessons and what to do

Sources

AI coding agents keep installing archived MCP servers that will never get security fixes

AI-found PHP2Shell flaws are under active attack, CISA says — and now chained to root firewalls

OpenSSH 10.6p2 fixes a no-password login on Alpine and other musl systems — and speeds up releases, citing AI bug-hunting

Get the daily brief