Linux Exploit Puts Unpatched Ubuntu Servers at Risk

An internal Claude model helped Anthropic build a Linux exploit that could reportedly take control of a vulnerable server without credentials. Canonical’s latest supplied status, dated October 30, listed affected Ubuntu releases as vulnerable work in progress. The upstream record rates CVE-2026-98432 Critical, but Anthropic’s demonstration required a specific network configuration. AWS said it was not aware of exploitation in the wild.

• Anthropic said the exploit could reach root remotely on a server with a multipath TCP listener, without credentials or user interaction.
• The IPv4 TCP use-after-free bug dates back to Linux 4.4, according to the upstream CVE record.
• Canonical listed Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as vulnerable work in progress.
• Red Hat rated the flaw Critical and said it was expediting fixes. AWS and Debian listed fixed kernel packages.
• AWS’s statement was a point-in-time assessment, not proof that exploitation was impossible.

Linux exploit timeline

1. October 27, 2026: Anthropic’s Frontier Red Team described how an unreleased internal Claude model helped identify and exploit vulnerabilities in software, including Linux. The company said it reported findings through coordinated disclosure, allowing vendors 90 days to patch and a further 45 days before broader discussion.
2. October 30, 2026: Canonical’s CVE page listed affected Ubuntu releases as vulnerable work in progress. Red Hat rated the issue Critical and said it was expediting fixes.
3. November 1, 2026: AWS said fixed packages were available for Amazon Linux 2 and Amazon Linux 2023. AWS said a kernel update and reboot are required for the fix to take effect.
4. November 2, 2026: Decrypt reported that Ubuntu still had no fix and that Red Hat had patched the issue. Canonical’s cited page was last updated October 30, so its status should be read with that date in mind.

Background on the Ubuntu kernel vulnerability

The Linux exploit targets memory handling in the IPv4 TCP stack. The upstream record describes a use-after-free issue involving socket-option memory. Its fix defers freeing the affected memory until after an RCU grace period. The record says IPv6 is not affected by the main issue because its corresponding connection path duplicates the options.

CVE-2026-98432 has a CVSS 3.1 score of 9.8, classified as Critical. The upstream record lists fixes in branches including 5.10.272, 6.1.190 and 6.12.113. Canonical’s page, last updated October 30, assigned Ubuntu priority “High” while displaying the 9.8 Critical score. These are labels from different assessment systems.

Anthropic described the exploit sequence: Claude took 48 minutes to leak a kernel pointer, then another five minutes to execute a shell command. The remote demonstration needed no credentials or user action, but it did require a server with a multipath TCP listener. It does not establish that every Linux or Ubuntu machine can be compromised in the same way.

Anthropic’s research report says the broader effort also examined Chrome, Safari, Android and Windows. The report describes findings reported through a coordinated-disclosure process, with 90 days for vendors to patch and another 45 days before broader discussion.

Reactions and distribution status

Canonical’s CVE status page listed four Ubuntu releases with the core Linux package marked “Vulnerable work in progress.” The page was last updated October 30. Check Canonical’s advisory for any later status changes.

Red Hat’s October 30 bulletin rated the vulnerability Critical and said it was expediting fixes. It warned that filtering incoming IPv4 packets containing IP options could reduce exposure, but was not a substitute for a kernel update. Decrypt reported on November 2 that Red Hat had patched the flaw. AWS said fixed Amazon Linux packages were available on November 1 and that it was not aware of exploitation in the wild. Debian’s tracker lists fixes for Debian 12 and 13.

The supplied market data does not connect the Linux vulnerability to crypto prices. At 22:13 UTC on November 2, Bitcoin was $76,766, down 1.28% over 24 hours, while Ether was $2,255.90, down 0.19%. These figures provide market context only and should not be read as a reaction to the vulnerability report.

What to watch next

The immediate question for Ubuntu users is whether Canonical publishes updated kernel packages for the listed releases. The supplied Canonical page showed the core Linux package as vulnerable work in progress on October 30. Upstream fixes and packages listed by other distributions do not, by themselves, establish that an Ubuntu update is available.

Watch for revised advisories and credible reports of exploitation. Red Hat described packet filtering as a way to reduce exposure, not as a substitute for a kernel update. AWS said a server must reboot after the kernel update for the fix to take effect.

Anthropic’s demonstration shows a route to root under the stated configuration, but the evidence does not show that any particular service or organization was compromised. Exposure depends on the distribution, installed kernel package and system configuration.

FAQ

What is the Linux exploit in CVE-2026-98432?

It is a proof of concept for an IPv4 TCP use-after-free flaw in the Linux kernel. Anthropic said it could reach root remotely on a server with a multipath TCP listener, without credentials or user interaction.

Is the Ubuntu kernel vulnerability patched?

Canonical’s CVE page, last updated October 30, listed Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as vulnerable work in progress. Check its current advisory for later package-status changes.

Does the Linux exploit affect every server?

No. Anthropic’s demonstration required a server with a multipath TCP listener. The upstream advisory says the main issue does not affect IPv6. Exposure also depends on the installed kernel and system configuration.

Sources

• Discovering and exploiting vulnerabilities in critical, real-world software with Claude (www.anthropic.com)
• CVE-2026-98432 | Ubuntu (ubuntu.com)
• Claude-Built Linux Exploit Targets Bug That Ubuntu Still Hasn't Patched (Decrypt)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.