Claude discovers a severe Linux kernel vulnerability that lay dormant for 11 years and generates a working exploit
English text is being prepared.
Anthropic's Claude model discovered a use-after-free (UAF) flaw in the Linux kernel's IPv4 TCP handshake. The code was submitted in October 2015 and introduced with Linux 4.4; an attacker can trigger remote root privilege execution through network traffic without a password or user interaction. Claude also generated a working two-stage exploit: the first stage took about 48 minutes to defeat kernel address space layout randomization protections, and the second stage took only 5 minutes to execute arbitrary commands with root privileges. The whole process took about 53 minutes, and a failure does not cause the target to crash. The upstream fix was completed on October 15, covering 5.10.272, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7, but as of November 1, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 are still marked as affected, and the fix is still under development.
Why read this
AI score 84
The original text provides the root cause of the vulnerability, the time required for exploitation, and the scope of patch coverage, so readers can use it to assess the exposure window in Ubuntu environments.
Topics
Body
漏洞的根源是IPv4 TCP握手中的释放后使用（UAF）缺陷。代码于2015年10月提交，随Linux 4.4内核引入，在处理TCP连接重传时，一个CPU可能读取另一个CPU已经释放的内存。
攻击者无需密码、无需任何用户交互，仅通过网络流量即可触发，进而实现远程Root权限执行。内核CVE团队将其定性为网络可达、无需特权、无需交互的严重漏洞。
更令人警惕的是AI在其中的角色。Anthropic的Claude模型不仅发现了漏洞，还生成了可用的两阶段利用程序。第一阶段耗时约48分钟，破解内核地址随机化保护；第二阶段仅用5分钟，便以Root权限执行任意命令。整个攻击过程约53分钟，且利用失败不会导致目标崩溃，攻击者可以反复尝试。
上游修复已于10月15日完成，修复版本覆盖5.10.272、6.1.190、6.12.113、6.18.56、7.2.10及7.3-rc7。Debian、Red Hat、Amazon Linux等发行版已陆续发布补丁。
但Ubuntu的情况截然不同：截至11月1日，Ubuntu 22.04 LTS、24.04 LTS、26.04 LTS及26.10仍被标记为受影响，修复程序尚在开发中。
对于运行对外服务的Ubuntu管理员，风险窗口仍在敞开。Go 1.24及更高版本在Linux上默认启用Multipath TCP，可能扩大该漏洞的暴露面，但禁用MPTCP只能降低风险，无法消除内核层面的缺陷。
Anthropic表示该利用代码未公开发布，但这次事件已经清晰展示了一个趋势：AI不再只是写代码的工具，它同样可以成为拆解系统防线的武器。