Unreleased Anthropic model finds Linux kernel flaw as Red Hat and Ubuntu lag on patches

Anthropic reported on October 27 that its Frontier Red Team used an unreleased internal research model to find and exploit critical vulnerabilities in widely used software, producing five working attack chains. Four targeted Chrome, Safari, Android and Windows. The fifth targeted Linux and ended in a zero-click remote root exploit for CVE-2026-98432, a use-after-free in the kernel's IPv4 TCP handshake. The work was part of a broader effort to test AI models' ability to find and exploit flaws in widely deployed software.

The Linux flaw is a race condition in how the kernel handles IP options during incoming IPv4 TCP connection setup. When a SYN packet carrying IPv4 options arrives, the kernel keeps a copy with the pending connection so it can echo them in the SYN-ACK. When the handshake completes, that copy is handed to the new socket without being duplicated. If the client retransmits its SYN, another CPU can build a SYN-ACK from the same options. If the new connection is closed and its socket freed in the meantime, the kernel frees the options immediately and the SYN-ACK path reads released memory. The bug goes back to Linux 4.4.

Anthropic's proof of concept used the MPTCP listener as its entry point. Stage one defeated Kernel Address Space Layout Randomization remotely by making the kernel read an attacker-controlled length field and echo extra bytes back, so an overread containing a kernel pointer revealed the address layout. Stage two overflowed a buffer and overwrote a callback pointer with the address of a payload already staged in kernel memory, ending in an attacker-chosen shell command running as root. The proof of concept took 48 minutes to leak a kernel pointer and another five minutes to reach shell execution, about 53 minutes in total. A lost race only fails the handshake, so an attacker can retry indefinitely.

The upstream fix was written by Eric Dumazet and titled ipv4: free inet_opt and ireq_opt after an RCU grace period. It waits until no other CPU can still be reading the options before freeing them. The patch was backported to maintained stable branches, but enterprise distributions move on their own schedules. As of October 30, Red Hat Enterprise Linux and Ubuntu had not shipped fixed kernels.

Key Facts

CSO Online reported on October 30 that CVE-2026-98432 carries a CVSS score of 9.8, rated Critical by the Linux kernel CVE team. The attack vector is network based, and exploitation requires no privileges and no user interaction. CSO Online also reported that the flaw affects eight kernel branches back to version 4.4 and that fixed releases include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7. The demonstrated exploit requires an exposed MPTCP listener, but the underlying bug is not specific to MPTCP.

AlmaLinux reported on October 30 that its engineers backported the upstream fix because no fixed Red Hat kernel existed at the time. Andrew Lukoshko wrote that the project ported the change from the 5.10, 5.15 and 6.12 stable kernels to every supported branch. Testing packages are kernel-4.18.0-553.180.2.el8_10 for AlmaLinux 8, kernel-5.14.0-687.61.2.el9_8 for AlmaLinux 9 and kernel-6.12.0-211.69.2.el10_2 for AlmaLinux 10. AlmaLinux 8, 9 and 10 are affected. The project also published a temporary nftables rule that drops inbound IPv4 TCP packets carrying IP options, expressed as ip hdrlength greater than 5, and noted that MPTCP is off by default on AlmaLinux. Neither the firewall rule nor disabling MPTCP is a fix, the post states.

The Go Security Team said in an advisory dated October 29 that Go 1.24 and later enable MPTCP by default for listen sockets on Linux where the kernel supports it. That means reverse proxies, API gateways, exporters, control-plane agents and in-house services built with Go 1.24 or later may open MPTCP listeners without administrators realizing. The advisory states that the best fix is to upgrade to a patched kernel. The advisory was forwarded to the oss-security list by Oracle's Alan Coopersmith on October 30.

Anthropic's broader research produced 62 Chrome CVEs patched as of Chrome 156, all critical or high, including 13 sandbox escapes and 21 renderer-compromise bugs. The Safari chain was a data-only attack that read history, cookies and authenticated responses from other sites. The Android chain used three flaws to pull photos and personal data from a locked Pixel 9 over USB without the passcode. The Windows chain was an out-of-bounds read in the kernel HTTP/3 QUIC stack, CVE-2026-33096, that could remotely crash servers Anthropic estimates number in the several millions.

Analysis

The bigger picture here is that the security bottleneck has moved from finding vulnerabilities to deploying fixes. Anthropic's model did not need a novel class of bug. It needed a race condition that has existed since Linux 4.4, a way to turn an information leak into an address disclosure, and a second stage that converts memory corruption into root. The most dangerous flaws are often compositions of ordinary mistakes rather than single spectacular defects.

That composition matters because the demonstrated exploit is patient. A failed race does not crash the target, so an attacker can try again. The 53 minute figure is not a countdown that every real intrusion would match, but it is short enough to change the economics of opportunistic attacks. Anthropic argues that frontier models can now combine flaws into working exploits once confined to specialist teams, and five chains across Chrome, Safari, Android, Windows and Linux give that claim more weight than a single proof of concept would.

The distribution response is the weaker part of the story. Upstream maintainers fixed the kernel and backported the change, yet Red Hat Enterprise Linux and Ubuntu had not shipped fixed kernels as of October 30. AlmaLinux moved ahead of Red Hat with backports for its supported branches, which shows that the technical work was feasible. Go's default behavior adds a quieter layer of exposure, because services that administrators do not think of as MPTCP services may open MPTCP listeners. What this really means is that defaults and inventory matter as much as patch availability.

Why It Matters

The flaw sits in the Linux kernel used by Red Hat Enterprise Linux, Ubuntu and AlmaLinux, so a remote root issue in IPv4 TCP handling reaches beyond a single vendor's product line. The flaw is not confined to an optional protocol module. It lives in code that sets up ordinary TCP connections, even though the demonstrated exploit uses MPTCP. The KASLR bypass and the callback overwrite turn a memory safety error into a reliable path to root, which is why the 9.8 score is not inflated.

The AI angle changes the disclosure calculus. Anthropic found five exploit chains in one research effort, including 62 Chrome CVEs patched by Chrome 156. That volume is hard to match with manual review at the same speed. The caveats are important: as of October 30, no in-the-wild exploitation had been reported, Anthropic had not published its exploit code, and the flaw was not in CISA's Known Exploited Vulnerabilities catalog. The absence of exploitation does not make the patch lag harmless, but it does mean the immediate risk is concentrated in exposure rather than confirmed attacks.

Next Up

The immediate items to watch are the fixed kernel releases from Red Hat Enterprise Linux and Ubuntu. Administrators should compare running kernels against the fixed versions listed for their branches and apply updates when their vendors publish them. Go users should also check whether their services rely on the default MPTCP behavior, and can disable it at runtime with GODEBUG=multipathtcp=0 or at build time with godebug multipathtcp=0 in the main module's go.mod. Per-socket controls through net.Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP override the GODEBUG setting.

Until patched kernels arrive, the AlmaLinux nftables rule offers a stopgap for inbound IPv4 TCP packets with IP options, and disabling MPTCP removes the exact configuration Anthropic exploited. Neither measure is a substitute for the kernel fix. The longer term question is whether AI assisted vulnerability research will keep producing multi-flaw chains faster than distributors can ship repairs, and whether the next disclosure will again find upstream fixed while major enterprise platforms wait.