Anthropic says an unreleased Claude model found a Linux kernel vulnerability that lay dormant for 11 years
Anthropic published a security research report stating that its internal unreleased Claude model, during systematic testing, discovered a critical Linux kernel vulnerability that had lain dormant for 11 years, CVE-2026-98432, with a CVSS score of 9.8, at the remote code execution level. The vulnerability stems from a use-after-free flaw in the IPv4 TCP handshake; the code was submitted in October 2015 and introduced with Linux 4.4, and an attacker can remotely obtain Root privileges without a password or user interaction. Claude also generated a working two-stage exploit: the first stage took about 48 minutes to defeat kernel address space randomization, and the second stage took 5 minutes to execute arbitrary commands with Root privileges, for a total of about 53 minutes. The upstream fix was completed on October 15, but as of November 1, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 are still marked as affected.
#Safety / alignment#Anthropic#Papers/Research