Claude Linux Exploit Gets Remote Root on Servers in 53 Minutes
A Claude Linux exploit written by an unreleased Anthropic research model can take over vulnerable Linux servers remotely as root, with no password and no user interaction. Anthropic’s Frontier Red Team says its proof of concept for the kernel flaw, tracked as CVE-2026-98432, needed about 53 minutes from first packet to root command. Fixes are already in the upstream Linux kernel, but several major distributions are still shipping updates.
How the Claude Linux Exploit Works
Anthropic described the attack in a research post published on October 27 that also covers Chrome, Safari, Android and Windows findings. After initial prompting by researchers, Claude wrote an exploit that targets Linux servers running a Multipath TCP (MPTCP) listener.
The underlying bug is a race condition that leads to a use-after-free in the kernel’s IPv4 TCP code. According to the Linux kernel CVE announcement, the kernel hands IP options from a pending connection request to a new socket without copying them. If another CPU core is building a SYNACK reply for a retransmitted connection request at the same moment, it can read memory that has already been freed.
The exploit runs in two stages:
- Defeating KASLR: the attacker wins the race to make the kernel send back extra bytes, leaking a kernel pointer. This took about 48 minutes in Anthropic’s test.
- Hijacking control flow: the same bug is used to overwrite a callback pointer, which then runs an attacker-chosen shell command as root. This took about five more minutes.
A lost race only fails the TCP handshake without crashing the server, so an attacker can simply keep retrying. Anthropic has not released the exploit code.
Which Linux Kernels Are Affected?
The flaw dates back to Linux 4.4. Fixed upstream releases are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7. MPTCP is opt-in, but the bug itself sits in IPv4 TCP handling, so the kernel team recommends moving to a patched stable kernel rather than relying on disabling one feature.
Severity ratings differ. The CVE carries a critical 9.8 CVSS score in several advisories, while Red Hat rates it “Important” with a draft score of 8.1, citing the high attack complexity of winning the race. Red Hat lists RHEL 8, 9 and 10 and OpenShift 4 as affected, with no mitigation it considers suitable. Ubuntu’s tracker still showed fixes in progress for its standard kernel packages as of October 30. No in-the-wild attacks have been reported so far.
What It Means for Server Admins
The finding is the latest sign that AI models are moving from spotting bugs to building working attacks. This week CrowdStrike showed state-backed hackers using AI agents against more than 200 organizations, and developer tools are a target too, as the fake Claude Code extension that backdoored Cursor users showed. On mobile, the recent Android SMS of Death bug is another reminder to install updates quickly.
For Linux admins, the advice is simple: check your running kernel version, install your distribution’s patched kernel as soon as it ships, reboot, and review whether any services expose MPTCP listeners to the internet. Anthropic says it follows a 90-day coordinated disclosure policy, so more details on its other findings may follow.
Your comment has been submitted,
it will be published after approval.