Security researchers at Anthropic have created an exploit for a critical Linux kernel vulnerability that permits unauthenticated attackers to remotely execute commands with root privileges on servers running Multipath TCP listeners. Tracked as CVE-2026-98432, this use-after-free flaw affects Linux kernels dating back to version 4.4 and impacts major distributions including Ubuntu, Red Hat Enterprise Linux, and Rocky Linux. While the vulnerability also affects ordinary TCP connections, remote code execution has only been demonstrated on servers with MPTCP listeners active.
The flaw stems from a race condition in how the kernel handles TCP connection requests. Anthropic’s AI model developed an exploit that bypassed kernel security protections and achieved root-level code execution in approximately 53 minutes. Multiple Linux vendors have begun releasing patches, though security updates remain in progress for several distributions. Administrators should install kernel updates when available, and temporary mitigations include restricting network access and blocking specific IPv4 TCP traffic. No active exploitation of this vulnerability has been reported in the wild.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
