1 source 30m ago
Anthropic Demonstrates Root Takeover Attack on Linux Kernel Flaw Rated 9.8
Anthropic announced on October 27 that it demonstrated an attack exploiting a Linux kernel vulnerability, CVE-2026-98432, to run commands with administrator privileges without authentication.
Reporting from 1 source: ASCII.jp.
Why it matters
The demonstration shows that AI-generated attack code can turn a network-reachable kernel use-after-free into unauthenticated root access, so the only real defense left is how quickly administrators apply their distribution's fix.
Key Facts
- Anthropic announced on October 27 that it demonstrated an attack exploiting Linux kernel vulnerability CVE-2026-98432 to execute commands with administrator privileges without authentication.
- CVE-2026-98432 is rated 9.8 out of 10 for severity and is a use-after-free flaw in the Linux kernel's IPv4 communication processing.
- The attack was carried out against an MPTCP listening server using attack code created by AI.
- The CVE team disclosed the vulnerability on October 15, and the fix was incorporated into the stable kernel.
- Ubuntu's October 29 update information lists multiple versions as under repair or in a vulnerable state.
The flaw is a use-after-free in IPv4 TCP connection processing, rated 9.8 for severity, and exploitable over the network with no user action. The CVE team disclosed it on October 15 and the fix landed in the stable kernel, but Ubuntu's October 29 update lists several versions as under repair or still vulnerable.
The attack targeted an MPTCP listening server, which handles TCP connections across multiple network paths, and the exploit code was created by AI. The flaw sits in IPv4 communication processing and is reachable over the network without authentication or any action from the user. The CVE team disclosed CVE-2026-98432 on October 15, and the fix went into the stable kernel. That leaves the update lag at the distribution level: Ubuntu's October 29 advisory lists multiple versions as under repair or still vulnerable, and administrators are told to check the fix status published by the Linux distribution they run and apply updates.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google