Ubuntu and RHEL still have no patch for a critical Linux kernel bug

Anthropic has disclosed a critical Linux kernel vulnerability, CVE-2026-98432, that an unreleased internal Claude model turned into a working remote-root exploit. Published 27 October in a Frontier Red Team research post, the writeup says the model built a full exploit chain for Linux MPTCP listeners after only initial prompting: 48 minutes to leak a kernel pointer, five more to get a root shell.

The bug itself is a race-condition use-after-free in the kernel’s TCP code: tcp_v4_syn_recv_sock() hands ownership of connection options to a child socket without copying them, so a concurrent retransmitted SYN can read memory that’s already been freed. The Linux kernel CVE team rates it 9.8; Red Hat scores it lower, at 5.9, arguing exploitation needs more than a single crafted packet. It’s fixed upstream, in versions including 5.15.223, 6.1.190 and 6.12.113, and Debian has shipped patched kernels, but as of 30 October neither Ubuntu nor RHEL has a fix out.

Why it matters: MPTCP has to be explicitly enabled to be exploitable, but Go 1.24 turns on MPTCP listeners by default on Linux, so some servers may be exposed without anyone having asked for it. If you’re running Ubuntu or RHEL and can’t confirm a patched kernel yet, check whether MPTCP is actually in use before assuming you’re safe.

The caveat: this is disclosed research under Anthropic’s own coordinated-disclosure policy, not an attack seen in the wild, and Red Hat disputes how easily it can actually be triggered.