An advanced AI model developed by Anthropic has identified a significant security vulnerability in the Linux kernel, designated as CVE-2026-98432. This flaw, if exploited, enables remote attackers to execute commands with root privileges without requiring user interaction. The discovery highlights the increasing role of AI in cybersecurity.
Identification and Disclosure
On October 27, 2026, Anthropic’s Frontier Red Team unveiled the exploit, confirming that the vulnerability has been addressed in the latest upstream patches. The company’s research emphasizes that this was a controlled lab experiment rather than a real-world attack. The exploit specifically targets Linux servers utilizing a multipath TCP listener, revealing a race condition that triggers a use-after-free error within the kernel’s networking stack.
The mechanism involves manipulating the race condition to extract memory layout information, subsequently bypassing KASLR defenses. By overwriting a callback pointer, the exploit executes a preloaded payload on the kernel, culminating in root command execution. Despite the complexity, this exploit underscores the potential of AI in automating sophisticated attack chains.
Technical Analysis
The vulnerability allows attackers to retry the exploit repeatedly, with a successful proof of concept demonstrating a 48-minute timeframe to leak crucial pointers and an additional five minutes to execute the root command. Public records provide a slightly different narrative, with the Ubuntu CVE entry dated October 15, 2026, and updated on October 28, assigning a critical CVSS score of 9.8.
The technical details describe an issue in the handling of IP options during TCP handshake processes, leading to the use-after-free bug. The fix involves delaying the freeing of resources until after an RCU grace period, mitigating the vulnerability. Notably, the official records do not mention multipath TCP, leading to some discrepancies in the vulnerability’s exact attack vector as highlighted by third-party sources.
Patch Implementation and Future Implications
The vulnerability has been patched across all maintained stable kernel branches, including versions 5.10.272, 5.15.223, 6.1.190, and others. However, distribution-specific updates vary, with certain Ubuntu versions still marked as vulnerable. Users are advised to verify patch numbers with official sources like kernel.org.
Anthropic’s findings demonstrate AI’s capability to identify and chain vulnerabilities, a task once reserved for specialized human teams. This dual-use technology can aid both attackers and defenders, highlighting the importance of rapid patch deployment and monitoring of AI-generated vulnerabilities. The company has expanded its Cyber Verification Program to leverage AI tools for defensive security measures.
To mitigate risks, system administrators should update to the latest kernel version and reboot. If updates are unavailable, disabling unnecessary multipath TCP listeners and enforcing strict firewall rules are recommended. Organizations using AI tools should regularly audit their systems to prevent similar vulnerabilities, acknowledging the shrinking gap between vulnerability discovery and exploitation.
.webp?ssl=1 "Mallory Enhances Security with Unified Threat Management")
