Anthropic says an unreleased Claude model found a Linux kernel vulnerability that lay dormant for 11 years, gaining Root in 53 minutes

Claude Uncovers a Vulnerability Hidden for 11 Years! Root Access in 53 Minutes: Ubuntu Still Has No Patch

Kuai Technology Download the Client for Exclusive Early Access November 02, 2026 12:13:56 From Henan Updated November 02, 2026 12:27:35

Kuai Technology, November 2 news: Anthropic recently released security research disclosing that its internal, unreleased Claude model, during systematic testing, discovered a severe vulnerability that had been hidden in the Linux kernel for as long as 11 years.

The vulnerability is numbered CVE-2026-98432, with a CVSS severity score as high as 9.8, placing it among the most critical vulnerabilities at the remote code execution level.

The root cause of the vulnerability is a use-after-free (UAF) flaw in the IPv4 TCP handshake. The code was submitted in October 2015 and introduced with the Linux 4.4 kernel; when handling TCP connection retransmissions, one CPU may read memory that another CPU has already freed.

An attacker needs no password and no user interaction whatsoever; the vulnerability can be triggered solely through network traffic, thereby achieving remote Root privilege execution. The kernel CVE team characterized it as a critical vulnerability that is network-reachable, requires no privileges, and requires no interaction.

Even more alarming is the role AI played in this. Anthropic's Claude model not only discovered the vulnerability but also generated a working two-stage exploit. The first stage took about 48 minutes, defeating the kernel's address space layout randomization protection; the second stage took only 5 minutes to execute arbitrary commands with Root privileges. The entire attack process took about 53 minutes, and a failed exploit does not crash the target, so an attacker can try repeatedly.

The upstream fix was completed on October 15, covering versions 5.10.272, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. Distributions such as Debian, Red Hat, and Amazon Linux have successively released patches.

But Ubuntu's situation is entirely different: as of November 1, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 are still marked as affected, and the fix is still under development.

For Ubuntu administrators running externally facing services, the risk window remains open. Go 1.24 and later versions enable Multipath TCP by default on Linux, which may expand the exposure surface of this vulnerability, but disabling MPTCP can only reduce the risk and cannot eliminate the defect at the kernel level.

Anthropic stated that the exploit code has not been publicly released, but this incident has clearly demonstrated a trend: AI is no longer just a tool for writing code; it can likewise become a weapon for breaking down a system's defenses.

"Special Statement: The above content (including videos, images, and audio if any) is uploaded and published by users of 'Dafeng Hao,' a self-media platform under Phoenix Net. This platform only provides information storage space services.

Notice: The content above (including the videos, pictures and audios if any) is uploaded and posted by the user of Dafeng Hao, which is a social media platform and merely provides information storage space services."