Claude discovered a serious vulnerability that has been lurking in the Linux kernel for 11 years. Anthropic recently released a security study that revealed that its internal unreleased Claude model discovered a serious vulnerability that had been lurking in the Linux kernel for 11 years during systematic testing.

Claude discovered a serious vulnerability that had been lurking in the Linux kernel for 11 years. Anthropic recently released a security study that revealed that during systematic testing of its internal unreleased Claude model, a serious vulnerability that had been lurking in the Linux kernel for 11 years was discovered. The vulnerability is numbered CVE-2026-98432 and has a CVSS severity score of 9.8, making it the most dangerous vulnerability at the remote code execution level. The root cause of the vulnerability is a use-after-free (UAF) flaw in the IPv4 TCP handshake. The code was submitted in October 2015 and introduced with the Linux 4.4 kernel. When processing TCP connection retransmissions, one CPU may read memory that has been released by another CPU. The attacker does not need a password or any user interaction, and can be triggered only through network traffic, thereby achieving remote root permission execution. The kernel CVE team characterized it as a serious vulnerability that is network reachable, requires no privileges, and does not require interaction. What is even more alarming is the role of AI in it. The Claude model of Anthropic not only discovered the vulnerability but also generated a usable two-stage exploit. The first stage takes about 48 minutes to crack the kernel address randomization protection; the second stage only takes 5 minutes to execute arbitrary commands with Root privileges. The entire attack process takes about 53 minutes, and failure to exploit will not cause the target to collapse, and the attacker can try again and again. The upstream repair was completed on October 15, and the repaired versions cover 5.10.272, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7. Debian, Red Hat, Amazon Linux and other distributions have successively released patches. But the situation with Ubuntu is completely different: As of November 1, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 are still marked as affected, and fixes are still in development. For Ubuntu administrators running external services, the risk window is still open. Go 1.24 and higher versions enable Multipath TCP by default on Linux, which may expand the vulnerability's exposure. However, disabling MPTCP can only reduce the risk but cannot eliminate kernel-level flaws. Anthropic stated that the exploit code has not been released publicly, but this incident has clearly demonstrated a trend: AI is no longer just a tool for writing code, it can also become a weapon for dismantling system defenses. via cnBeta.COM - Chinese industry information station (author: Source: Kuai Technology)