The Linux Kernel Race Behind Anthropic’s Root Exploit
Anthropic describes a model-written exploit for a Linux kernel use-after-free. The upstream patch identifies the IPv4 TCP lifetime bug; Anthropic explains how its proof of concept reportedly reached it through an MPTCP listener and chained it to root command execution.
A sentence in a research post can travel farther than the evidence behind it.
On October 27, Anthropic published a report about an unreleased internal research model finding and exploiting vulnerabilities in widely used software. Its Linux example is striking: after an initial prompt, Claude wrote a proof of concept that, according to Anthropic, could turn network packets into a root shell on a Linux server with a Multipath TCP listener.
Anthropic links the example to CVE-2026-98432. The Linux kernel CNA record names the underlying issue as an IPv4 TCP use-after-free involving inet_opt and ireq_opt, fixed by freeing those structures after an RCU grace period. Anthropic’s account adds the exploitation context: it says the proof of concept targeted a server with an MPTCP listener, leaked a kernel pointer and then reached root command execution.
These sources describe different layers of the same report: the CNA bulletin identifies the memory-lifetime flaw and its fix; Anthropic explains the exploit path it says the model built. The upstream patch’s Reported-by field names Xinyang Ge of Anthropic, connecting the disclosure to the fix. The patch does not itself document the full exploit chain or establish exploitation in the wild.
What Anthropic reports
Anthropic says it used an unreleased internal research model over several months to investigate high-impact software. The post presents five examples across Chrome, Safari, Android, Windows and Linux.
For Linux, Anthropic says that after initial prompting, Claude wrote an exploit for a race-condition use-after-free in the kernel networking stack. The report describes a proof of concept against a server with an MPTCP listener. Anthropic says the demonstration first disclosed a kernel pointer and then reached command execution as root. Its reported run took 48 minutes for the pointer leak and another five minutes to reach the shell.
Those are claims about a controlled proof of concept, not evidence of attacks in the wild. The wording also matters: Anthropic describes initial prompting followed by model-written exploit work. That is not the same as saying the model independently selected the target, started the research without direction, or operated against public servers on its own.
What the CVE record says
The Linux CNA bulletin for CVE-2026-98432 has a specific subject: “ipv4: free inet_opt and ireq_opt after an RCU grace period.” It explains a race in IPv4 TCP connection handling. One path transfers option data from a request socket to a child socket while another CPU can still be reading it under RCU protection. A plain kfree() could release the memory too early; the fix uses kfree_rcu() in the relevant destructors.
This is the bug identifier and patch-level explanation. Anthropic’s post supplies the exploit narrative that the short CVE entry does not: its report says the proof of concept required an MPTCP listener, won the race to obtain a kernel pointer, then used the same use-after-free to reach a root shell. Anthropic does not publish the exploit code in this post, so readers cannot independently reproduce that chain from the article alone. The patch’s Reported-by: Xinyang Ge <xinyang@anthropic.com> is primary-source evidence that an Anthropic researcher reported the underlying issue upstream.
The bulletin records the issue as introduced by a TCP/DCCP request-socket change and lists stable kernel fixes, including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The upstream record connects the CVE to the reported issue; Anthropic’s longer post describes the proof-of-concept chain built on it. Check your distribution’s security advisory and apply the applicable kernel update for your installed release.
| Question | Anthropic’s Linux example | Linux CNA record for CVE-2026-98432 |
|---|---|---|
| Layer | Anthropic’s report | Linux CNA bulletin and upstream patch |
| Vulnerability | Describes a race-condition use-after-free in the kernel networking stack | Names the IPv4 inet_opt / ireq_opt lifetime bug |
| Exploit context | Says a remote attacker needs a server with an MPTCP listener | The CNA bulletin explains the TCP request-socket race; the patch delays freeing until an RCU grace period |
| Impact | Anthropic reports a proof of concept that leaks a pointer and reaches root command execution | The CVE entry identifies a critical remote issue; the patch itself does not describe the full exploit chain |
| Disclosure link | Cites CVE-2026-98432 | Upstream patch lists Anthropic researcher Xinyang Ge as the reporter |
The connection is visible in the original Linux CNA bulletin, the upstream stable patch and the CVE record imported by OSV. The patch’s reporter field names Xinyang Ge at Anthropic. Anthropic’s October 27 report adds the MPTCP precondition and the two-stage proof-of-concept result.
Read the CVE and the exploit report together
A CVE entry is not a full exploit write-up. Here, the Linux CNA record explains the bug and the upstream fix; Anthropic provides the reported exploitation precondition and impact. The patch’s Reported-by line bridges the disclosure to the kernel fix, while Anthropic’s post gives the broader account of how the model turned the bug into a working proof of concept.
The limits still matter. Anthropic says the work began after an initial prompt. Its article is the source for the MPTCP listener requirement, pointer leak, root command and timing. The kernel patch confirms the underlying use-after-free and fix, not those proof-of-concept milestones. Neither source says that attackers are exploiting this chain in the wild.
For readers, that separation is useful: the CVE helps locate the affected kernel code and stable fixes; the research post describes a particular path through the bug. A severity score alone does not communicate the conditions needed for the demonstrated exploit.
What defenders should do
If you administer Linux systems, use your distribution’s security advisory and package status to decide whether a kernel update is needed for CVE-2026-98432. Apply the fixes listed by the Linux kernel CNA and your distribution’s advisory. Anthropic’s report says the demonstrated path required a server with an MPTCP listener; its public post does not give enough detail to reproduce the proof of concept independently.
For teams tracking the Anthropic report, keep the CVE record and the exploit narrative as distinct layers in the same evidence packet. Record the affected protocol, code path, upstream commit, stable backports, reported exploit preconditions, and the vendor statement. This makes it easier to see what the patch establishes and what the research team reports about exploitability.
For model developers, the broader result remains consequential: Anthropic says its internal model produced sophisticated exploit code after initial prompting. The public report is a claim from the organization that ran the evaluation, and it deserves technical scrutiny at the same time as it deserves attention.
Sources
- Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude — October 27, 2026.
- Linux kernel CNA bulletin: CVE-2026-98432 — authoritative description and stable fix list.
- Upstream stable patch — includes a
Reported-bycredit to Xinyang Ge of Anthropic. - OSV entry for CVE-2026-98432 — imports the Linux CNA record and provides affected version ranges.
Follow jpalanco.com for more technical notes on AI, software engineering and security research.
