Anthropic says an unreleased Claude model found a Linux kernel vulnerability that lay dormant for 11 years, gaining Root in 53 minutes
Anthropic disclosed that its internal unreleased Claude model, during systematic testing, discovered a serious Linux kernel vulnerability that had lain dormant for 11 years, CVE-2026-98432, with a CVSS score of 9.8, at the remote code execution level. The model also generated a working two-stage exploit: the first stage took about 48 minutes to defeat kernel address space randomization, and the second stage took 5 minutes to execute arbitrary commands with Root privileges, for a total of about 53 minutes. The upstream fix was completed on October 15, but as of November 1, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 are still marked as affected, and the fix is still in development.
Why read thisAnthropic disclosed that an unreleased Claude model discovered a high-severity Linux kernel vulnerability that had lain dormant for 11 years and generated a working exploit; Ubuntu has still not fixed it.