Linux MPTCP Kernel Flaw Enables Remote Root Command Execution

A remotely reachable Linux kernel flaw can turn an MPTCP listener into a path to root access, without requiring a login or any action from a user. Anthropic says an unreleased Claude research model developed a working exploit for the bug, tracked as CVE-2026-98432. The claim puts a practical question behind the broader debate about AI-assisted security research: can a model connect a subtle kernel bug to a complete attack, rather than merely identify suspicious code?

The proof of concept took about 53 minutes to move from a kernel memory leak to running an attacker-controlled command as root, according to Anthropic’s account of the Linux exploit. That is a reported result from the company, not a general measure of how quickly AI can exploit Linux flaws. Anthropic presented this case as one of five exploit chains spanning Chrome, Safari, Android, Windows, and Linux, as part of research into AI-assisted vulnerability discovery and exploitation.

The distinction between finding a bug and building an exploit matters. A vulnerability report can identify a dangerous condition while leaving substantial work to show that an attacker can trigger it reliably, bypass protections, and reach a useful outcome. Here, Anthropic says its model crossed those steps. That makes the result more significant than a code-scanning demonstration, though the account alone doesn't establish how often similar systems will succeed on other flaws.

A race during connection setup

The bug sits in Linux’s handling of IP options during IPv4 TCP connection establishment. When a new socket is created, the kernel can transfer IP options from a pending connection request without copying them. At the same time, another CPU may be handling a retransmitted request and reading those options to build a SYNACK response. Both operations involve the same underlying data, so their timing matters.

If the new socket is freed before that read finishes, the second CPU can access memory that’s already been released. This is a use-after-free: one part of the kernel treats an object as finished while another part still expects to read it. Such bugs can be difficult to reproduce because the failure depends on operations overlapping in a particular order. In this case, Anthropic says the exploit turned that timing window into a way to expose kernel memory, bypass Kernel Address Space Layout Randomization (KASLR), and take control of kernel execution.

KASLR makes kernel memory locations less predictable, complicating attempts to use a memory error as a stepping stone to code execution. A leak can weaken that protection by revealing information about where kernel components reside. Anthropic’s account describes the exploit as a chain: first obtain the leak, then use it to work around KASLR, and finally reach root-level command execution. The chain is what makes the reported result operationally serious.

The kernel advisory describes the underlying connection-management issue. The upstream fix delays release of affected objects until an RCU grace period has passed, giving concurrent readers time to finish before the memory is freed. RCU is a kernel mechanism for coordinating access to data that may be read concurrently; the fix addresses the unsafe timing at the heart of this bug. Further detail on MPTCP is available in the kernel’s documentation.

The vulnerability carries a severity score of 9.8 and affects eight kernel branches, with exposure reaching back to version 4.4. Fixed releases are 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. That spread makes version checking more complicated than looking at a single current kernel: distributions often maintain separate package lines, and their fixes may arrive on different schedules.

Exposure depends on MPTCP use

Anthropic’s exploit targets systems with an MPTCP listener. Multipath TCP lets a single connection use multiple network interfaces, supporting bandwidth aggregation, network selection, and failover. The feature is useful where a connection may benefit from more than one network path, but its presence alone doesn't mean every Linux machine is reachable through this flaw.

Linux applications must generally opt into MPTCP when creating sockets, though eBPF and other configuration methods can also enable it. The relevant exposure question is therefore specific: does a vulnerable system have an MPTCP listener reachable by an attacker? If you're working in this space, checking kernel versions and package advisories is only part of the review; you’ll also want to understand whether MPTCP is enabled and which services are listening.

(And this is the part most people overlook.) A kernel flaw can be severe while the practical attack surface remains limited to systems with the affected configuration. That doesn't make the issue easy to dismiss: configuration may differ across hosts, and administrators may not have a single inventory that answers where listeners are exposed. The work is in connecting the patched version to the actual network-facing service.

As of October 30, patched packages were available for at least some releases from Debian, Oracle Linux, SUSE, and Amazon Linux. Ubuntu and Red Hat Enterprise Linux had not yet released patched kernels. Package status can change, so administrators should check their distribution’s current kernel package information, identify systems exposing MPTCP listeners, and apply the relevant fixed release when available.

What the exploit claim means

Anthropic’s result is a useful warning about the distance between vulnerability discovery and exploitation. A model that can assemble a working chain may shorten part of the research process, but this case doesn't show that exploitation is automatic or that every identified kernel bug can be turned into root access. The reported 53 minutes describes this proof of concept under the conditions of Anthropic’s research; it shouldn’t be treated as a benchmark for all systems or attackers.

For defenders, the immediate implication is practical: prioritize the fixed kernel packages, then verify whether MPTCP listeners are exposed on systems that remain vulnerable. For security researchers, the case adds evidence that AI tools can contribute to complex exploit development. And yet the result still depends on a specific bug, a specific configuration, and a successful sequence of steps. The fragment that matters: capability is not universality.