# AI Model Generates Exploit for Critical Linux Kernel Vulnerability

*Published October 30, 2026*
*Source: [https://cybersecuritynews.com/linux-kernel-flaw-root-commands/](https://cybersecuritynews.com/linux-kernel-flaw-root-commands/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/ai-model-generates-exploit-for-critical-linux-kernel-vulnerability) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Anthropic has revealed that an unreleased version of its Claude research model developed an exploit for a significant Linux kernel vulnerability, identified as CVE-2026-98432. This exploit allows remote attackers to execute commands with root privileges without requiring user interaction. The discovery was reported by Anthropic's Frontier Red Team on October 27, 2026, and the flaw has since been patched in the upstream kernel.

The exploit was crafted following a prompt from a researcher and targets Linux servers with a multipath TCP listener. The issue stems from a race condition leading to a use-after-free bug in the kernel's networking stack, where memory is used after it has been released by the system. The exploit operates in two phases: initially, it manipulates the race condition to leak a kernel pointer, bypassing Kernel Address Space Layout Randomization (KASLR), and then it overwrites a callback pointer to execute a payload as root.

Anthropic clarifies that this was a controlled lab test and not a real-world incident. The public documentation on the CVE, specifically from Ubuntu, describes a fix involving the proper handling of IP options to prevent use-after-free errors. The Ubuntu advisory notes the vulnerability as critical with a CVSS score of 9.8, highlighting the urgency of addressing it.

Despite the patch being available, distribution of fixes varies. At the time of writing, several versions of Ubuntu, along with cloud kernels for platforms like AWS, Azure, and GCP, remain vulnerable. Oracle Linux has already released patched versions. Organizations are advised to prioritize patching internet-facing servers.

The broader implication is the speed at which AI models can now identify and exploit vulnerabilities, a task previously reserved for skilled human teams. This capability highlights the dual-use nature of AI in cybersecurity, as it can aid both attackers and defenders. Anthropic emphasizes the potential benefits for defenders through its Cyber Verification Program, suggesting that AI tools can also bolster security efforts by identifying and patching vulnerabilities more efficiently.