Claude Developed Exploit for Linux Vulnerability in 53 Minutes – CVE-2026-98432

Claude developed an exploit for the Linux vulnerability CVE-2026-98432 in 53 minutes. The attack grants remote root access, patches are available.

In the case of the Claude Linux vulnerability, Anthropic's unpublished research model did a serious job. After receiving the first task, Model developed a self-running exploit for a vulnerability in the Linux kernel. Moreover, this exploit allows the attacker to execute commands remotely with root privilege. Root means the highest level administrative authority in the system.

Additionally, no account or user action is required for the attack. For the attacker, it is enough to establish a TCP connection with the server. TCP is the basic connection protocol that devices use to exchange data on the Internet.

What Happened in the Claude Linux Vulnerability Demo?

Anthropic announced this success of the model on October 27. In the demonstration, the exploit targeted a multipath TCP (MPTCP) enabled server. First, KASLR protection had to be overcome. KASLR is a defense method that places the kernel at a random location in memory.

This step took approximately 48 minutes. Then it took another five minutes to gain control and run commands as root. Thus, the total time reached 53 minutes. However, Anthropic did not release the exploit itself.

How Does CVE-2026-98432 Vulnerability Work?

This vulnerability, called the Claude Linux vulnerability, is related to the processing of IPv4 TCP connections. When establishing a connection, two processor cores can access the same data at the same time. For example, while one of them is freeing the allocated memory, the other can continue reading that area.

This type of error is known as use-after-free, that is, the use of memory after it is freed. Therefore, the Linux kernel's memory can become corrupted. Under certain conditions, an attacker can even gain control of code execution.

The vulnerability has been in the Linux kernel since version 4.4. Additionally, the US's National Vulnerability Database (NVD) gave this vulnerability a score of 9.8 out of 10 on the CVSS scale. CVSS is a standardized scale that scores the severity of deficits. On the other hand, Red Hat gave 5.9 points because it is not easy for the attacker to win the race between two processor cores.

MPTCP, used in the demonstration, is a TCP extension that allows data transfer from multiple network interfaces within a single connection. However, the vulnerability is not limited to this protocol. Therefore, MPTCP stood out as a suitable way to demonstrate remote attack.

Which Versions Have Patches?

Fixes released for the Claude Linux vulnerability first made their way into the main Linux branch and stable kernel versions. Patched versions are: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3.

However, distributions are not progressing at the same pace. Ubuntu is still preparing its update. Red Hat, on the other hand, postponed the patch release for its corporate Linux distribution RHEL. On the other hand, no attack with CVE-2026-98432 was reported. Moreover, the vulnerability is not included in the actively exploited threats catalog of the US cyber security agency CISA.