Anthropic's Claude AI found a critical Linux flaw that could give hackers root access

Credit: Lucas Gouveia/How-To Geek Published Oct 30, 2026, 2:55 PM EDT Viraj Gawde is a Tech Journalist with bylines at Travel+Leisure India & South Asia, Android Headlines, 91Mobiles, Croma Unboxed, etc. He has written thousands of news pieces, how-to guides, product comparisons, listicles, and op-eds on consumer tech. Currently, Viraj is obsessed with the fast-evolving world of artificial intelligence and how it is reshaping the way we work, create, and use tech. As a curious generalist, Viraj's work extends into a wide range of subjects, formats, and storytelling styles. When away from desk, he is a finance, sports, and travel geek with a constant curiosity for new experiences. Sign in to your How-To Geek account Anthropic’s unreleased Claude AI model has uncovered a critical Linux kernel flaw. And it didn’t just stop at spotting it; it built an attack that could give someone root access, the highest level of control on Linux. The attacker can run commands, change settings, access files, and potentially take over the machine remotely. No clicks, file opening, or password needed. The flaw is tracked as CVE-2026-98432 and scores a critical 9.8 out of 10 in severity. This Linux kernel flaw is a bigger deal than it sounds A memory error becomes a working exploit The Linux kernel is the core part of the operating system. The vulnerability affects its networking code. The attack targets Linux servers listening for Multipath TCP or MPTCP, which lets a device use multiple network connections like Wi-Fi and mobile data for one session. The bug is a memory handling error called a “use-after-free” that tries to use memory after it’s been released. When a new connection is set up, Linux passes some connection settings to a fresh socket. Another CPU core might be using the same settings to answer a repeated request. However, if the first side clears them away too early, the second reads memory that’s already gone. An attacker can exploit this mistake to interfere with the kernel. Anthropic showed how this could happen with steps involving leaking kernel memory, bypassing KASLR (a protection that hides where key code sits), hijacking the kernel’s control flow, and finally running a shell command of their choice. The company’s proof-of-concept attack took about 53 minutes to go from the first leak to root-level access. Eight Linux kernel branches are affected by the vulnerability, that go back to version 4.4. The flaw has been fixed in kernel versions 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. However, patches may not arrive everywhere at once—especially for users who receive kernel updates through their Linux distributions. Debian, Oracle Linux, SUSE, and Amazon Linux have patched packages for some releases. Ubuntu and Red Hat Enterprise Linux haven’t reportedly shipped fixes at the time of writing this. Administrators should check their Linux kernel versions, install updates when available, and see whether their servers have MPTCP listeners enabled. Source: CSO