Anthropic discloses that Claude discovered a vulnerability that had lain dormant in the Linux kernel for 11 years

Nov 2

1. 16:23

   Sina TechRelated discussion

   Sina Tech joined this discussion ↗

   This post contributes to heat; it is not a formal report or confirmed fact.

2. 15:41

   Sina Tech

   Anthropic says an unreleased Claude model found a Linux kernel vulnerability that lay dormant for 11 years

   Anthropic published a security research report stating that its internal unreleased Claude model, during systematic testing, discovered a critical Linux kernel vulnerability that had lain dormant for 11 years, CVE-2026-98432, with a CVSS score of 9.8, at the remote code execution level. The vulnerability stems from a use-after-free flaw in the IPv4 TCP handshake; the code was submitted in October 2015 and introduced with Linux 4.4, and an attacker can remotely obtain Root privileges without a password or user interaction. Claude also generated a working two-stage exploit: the first stage took about 48 minutes to defeat kernel address space randomization, and the second stage took 5 minutes to execute arbitrary commands with Root privileges, for a total of about 53 minutes. The upstream fix was completed on October 15, but as of November 1, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 are still marked as affected.

   Expand summary
3. 14:17

   cnBeta

   Claude discovers a severe Linux kernel vulnerability that lay dormant for 11 years and generates a working exploit

   Anthropic's Claude model discovered a use-after-free (UAF) flaw in the Linux kernel's IPv4 TCP handshake. The code was submitted in October 2015 and introduced with Linux 4.4; an attacker can trigger remote root privilege execution through network traffic without a password or user interaction. Claude also generated a working two-stage exploit: the first stage took about 48 minutes to defeat kernel address space layout randomization protections, and the second stage took only 5 minutes to execute arbitrary commands with root privileges. The whole process took about 53 minutes, and a failure does not cause the target to crash. The upstream fix was completed on October 15, covering 5.10.272, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7, but as of November 1, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 are still marked as affected, and the fix is still under development.

   Expand summary
4. 14:03

   MediaNamaSelected

   Anthropic says its internal Claude research model targeted Chrome, Android, Windows and…

   Anthropic's Frontier Red Team report states that an unreleased internal Claude research model, after an initial prompt, generated complete multi-step vulnerability exploit chains for five targets: Chrome, Safari, Android, Windows and Linux, and the relevant vulnerabilities have all been reported to vendors and fixed. On the Chrome side, the model chained four vulnerabilities to achieve code execution outside the sandbox, for which Google assigned 62 CVEs and fixed them in Chrome 156; on the Linux side, it exploited a use-after-free vulnerability in multipath TCP to achieve zero-click root remote command execution. The report did not disclose the model's identity, number of attempts, cost or success rate, nor did it provide independent verification.

   Expand summary
5. 12:13

   Phoenix TechnologySelected

   Anthropic says an unreleased Claude model found a Linux kernel vulnerability that lay dormant for 11 years, gaining Root in 53 minutes

   Anthropic disclosed that its internal unreleased Claude model, during systematic testing, discovered a serious Linux kernel vulnerability that had lain dormant for 11 years, CVE-2026-98432, with a CVSS score of 9.8, at the remote code execution level. The model also generated a working two-stage exploit: the first stage took about 48 minutes to defeat kernel address space randomization, and the second stage took 5 minutes to execute arbitrary commands with Root privileges, for a total of about 53 minutes. The upstream fix was completed on October 15, but as of November 1, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 are still marked as affected, and the fix is still in development.

   Expand summary