An unreleased Claude model reached root on Linux CVE-2026-98432 in 53 minutes

Anthropic says an unreleased Claude model produced a remote-root result against a Linux server that was listening with multipath TCP. BleepingComputer’s October 30 account puts that lab run at about 53 minutes. The bug is CVE-2026-98432, a use-after-free in the kernel’s IPv4 TCP setup. The kernel team scored it 9.8. The code path dates to Linux 4.4.

The published account is a lab result from the company whose researcher reported the bug. Confirmed use in the wild was absent from that account. Fifty-three minutes is a measure of a controlled run. It is the reason to move a kernel, and it ends there.

What the lab result covers

Public reporting says the remote-root result was shown against a multipath TCP listener. The same demonstration has not been published against a server that never offered that feature. The bug itself sits in ordinary IPv4 TCP handling. CIQ, which supports Rocky Linux, says turning multipath TCP off leaves the flaw reachable over ordinary TCP. A kernel crash on a host you need is an outage on its own. The lab’s root result is the reason the narrower listener still gets patched this week.

Red Hat has published a lower score than the kernel team, on the view that the race is difficult and a crash is the likely field outcome. Difficulty is the open argument. Presence in the code is settled. A model in a lab already produced a result past a crash, on a listener current software can enable without a ticket.

Go 1.24 made the listener quiet

Multipath TCP lets one connection use more than one network path. Applications usually have to ask for it. Reporting on the October 30 story says Go 1.24 enables it by default for TCP listeners on Linux when the kernel supports the feature. A service built with that toolchain can be offering the listener the lab used, with no line in a config file that says so.

Find network services built with Go 1.24 or later and assume multipath TCP is on unless the binary or the config turns it off. Then patch the kernel. Turning the feature off leaves ordinary TCP able to hit the same bug. Inventory tells you who was listening that way. The package is what closes the hole.

Where the package stands

Upstream fixed the bug and carried the fix into maintained stable branches. Debian has published kernels, including 6.1.190-1 on Debian 12 and 6.12.113-1 on Debian 13. Oracle Linux, Amazon Linux, and SUSE have fixes on some of their kernel lines. As of October 30, Canonical still listed Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 as vulnerable, with fixes in progress. Red Hat listed RHEL 8, 9, and 10 as affected, with fixes planned. RHEL 7 is outside the bug. Rocky Linux 8, 9, and 10 are still waiting with that group.

Install the package the distribution advisory names, then reboot into it. Match the package name. A kernel that merely looks recent can still be the vulnerable build. Where the package is still absent, write the host down and limit new TCP sessions to addresses that already have a reason to connect. Management ports left open to the internet are the machines that cannot sit through an unpublished ship date.

CIQ has published temporary guidance for Rocky Linux hosts that still lack a kernel. Follow that note on those systems if you accept its limits. The kernel package remains the fix.

The detail that belongs on an AI desk is small. A model found a path from a network listener to root, in under an hour, in a lab, against a feature a current language turns on by default. The work on the host is still the kernel update.

This briefing relies on public reporting by BleepingComputer and on vendor advisories for CVE-2026-98432. It does not include exploit procedures or proof-of-concept detail.