Anthropic revealed that its Claude artificial intelligence model discovered an unpatched zero day flaw in the Linux kernel and created a functional remote exploit. The flaw carries a critical severity score of 9.8 out of 10, allowing attackers to gain unauthorized root access over an ordinary TCP connection. Upstream kernel maintainers released fixes across multiple branches, but several major distributions have not yet deployed the patch.
The security flaw, tracked as CVE 2026 98432, stems from a use after free race condition that occurs when 2 CPU cores handle the same network request simultaneously. One core frees the memory region containing connection parameters while the other core continues reading the data. The exploit begins by sending timed network packets to map the address layout of the target kernel. It then triggers a buffer overflow to overwrite a callback pointer, assembling an execution chain that executes shell commands with full administrative privileges.
Claude took 48 minutes to compromise the target server during testing. Most of that time was spent defeating KASLR defenses, which drop network sessions whenever memory read errors occur, while the actual remote code execution took 5 minutes. Fixes are available for kernel versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. System administrators must update local repositories manually if their specific distribution vendor has not packaged the update.
