Anthropic exploit for a Linux kernel bug gets root in 53 minutes

Anthropic disclosed an exploit, which is code that uses a bug, for a Linux kernel bug tracked as CVE-2026-98432, made with a research model that it did not release. An attacker with no login can start commands as root, the admin account, with no step by the user. Anthropic reports about 53 minutes from the first memory leak to a root command.

How it works

2 CPUs use the same memory. One CPU releases it while a different CPU continues to read it. The exploit leaks kernel memory and gets through KASLR, a protection that makes memory positions hard to find.

It then gets control of the kernel and starts a shell command.

The numbers

• Severity score: 9.8, a very high level.
• 8 kernel branches have the bug, back to version 4.4.
• Anthropic disclosed 5 exploit chains for large software, such as Chrome.

Debian and SUSE have repaired packages for some releases. Ubuntu and Red Hat had no repaired kernel on 30 October.

What is not known

Only servers with an MPTCP listener are open to this exploit. MPTCP is a protocol that uses many network paths in one connection.

Software must tell the system to use it, but other tools can make software use it. The source does not tell how many tries the model made.

Insight: Finding and using bugs is one skill

On 11 October, Anthropic started a free scanner that finds bugs in open source software. Then it showed that a model it did not release can go from a bug to root access in about 53 minutes. This reads as a contest of repair speed: the side that repairs first is more safe. 2 Linux companies had no repaired kernel on 30 October. Leaders must measure the time to repair.