A Linux kernel networking vulnerability can allow unauthenticated remote code execution, with Anthropic researchers demonstrating a working root-level exploit and major Linux vendors preparing security updates.
A critical Linux kernel vulnerability can allow an unauthenticated remote attacker to execute code with root privileges on affected systems, with Anthropic researchers demonstrating a working exploit against servers running a Multipath TCP listener.
The flaw, tracked as CVE-2026-98432, is a use-after-free vulnerability in the Linux kernel’s IPv4 TCP implementation. According to Canonical’s Ubuntu security advisory, it stems from a race condition in which socket options can be freed while another processor is still using them during TCP connection processing.
Anthropic disclosed the vulnerability as part of research into the ability of an internal AI model to discover and exploit security flaws in widely used software. The company said the vulnerability has already been fixed in the upstream Linux kernel and backported to maintained stable kernel branches.
Anthropic demonstrated remote root code execution
Anthropic said its unreleased research model developed an exploit that could send network packets to a Linux server with a Multipath TCP listener and ultimately run attacker-selected commands as root. The attack did not require credentials or user interaction.
The exploit worked in two stages. First, it abused the race condition to make the kernel return additional memory containing a kernel pointer, allowing the attacker to determine the layout of kernel memory and bypass Kernel Address Space Layout Randomization.
The second stage exploited the same use-after-free condition to corrupt memory and overwrite a callback pointer. The researchers used that control to redirect execution through existing kernel functions and ultimately execute a shell command with root privileges.
Winning the underlying race is not immediate. Anthropic said its proof of concept required about 48 minutes to obtain a kernel pointer and another five minutes to achieve command execution. Failed attempts generally disrupted the individual TCP handshake rather than crashing the entire system, allowing an attacker to keep retrying.
Red Hat rates the vulnerability Critical
Red Hat issued a security bulletin rating the vulnerability Critical and said it was expediting fixes for affected products. The company said a remote, unauthenticated attacker can exploit the race during TCP connection processing to achieve remote code execution. Affected products include Red Hat Enterprise Linux 8, 9 and 10, along with Red Hat OpenShift Container Platform and other products that rely on affected RHEL kernels.
Red Hat said systems accepting inbound TCP connections are the most directly exposed because the underlying vulnerability affects IPv4 TCP networking rather than an unusual application-level protocol. Exploitation requires carefully timed network requests but does not require privileges or user interaction.
Linux distributions are still rolling out fixes
Canonical rates CVE-2026-98432 as High priority for Ubuntu while listing a CVSS severity score of 9.8. As of October 30, its Ubuntu vulnerability tracker showed fixes for the standard kernels in Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as still in progress. Several cloud and hardware-specific Ubuntu kernel packages were also awaiting fixes.
Ubuntu’s advisory also says IPv6 is not affected by the primary vulnerability because the corresponding IPv6 TCP path duplicates the relevant options instead of transferring them in the same way. A related IPv6 migration issue involving a different option structure is being handled separately.
Although the vulnerability has been corrected upstream, organizations running Linux distributions depend on vendor-packaged kernels and backported fixes. Administrators operating internet-facing Linux systems should therefore check their distribution’s current security advisory and installed kernel packages rather than relying solely on the upstream kernel’s patch status.
Leave a Reply