A severe TCP flaw in the Linux kernel (CVE-2026-98432) allows unauthenticated remote root execution on servers with multipath TCP.
Anthropic reported its AI model wrote a working exploit in under an hour.
While some vendors shipped updates, Ubuntu and RHEL had no fixed kernel as of late October.
Anthropic announced on October 27 that its artificial intelligence model was able to write a program that exploits this vulnerability. According to the company, the process took a while to read system information and execute commands. Anthropic researcher Xinyang Ge is credited with reporting the problem to the Linux developers, who implemented a fix on October 5.
Severity disputes and updates
The companies that maintain the various Linux systems disagree on how dangerous the problem is. The Linux Kernel Security Team rated the issue 9,8 out of 10, while Amazon rated it 7,0, and Oracle and SUSE both gave it an 8,1. Red Hat and other vendors gave even lower scores, deeming successful exploitation more difficult.
As of October 29, there were no reports of attacks exploiting the issue in real-world settings. The issue does not affect IPv6 connections, as the system replicates the settings differently in that case.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Telegram bug allowed access to Android phones with just a call
↗
Some vendors, including Debian, Oracle Linux, SUSE, and Amazon Linux, have already released patches to fix the issue for some of their systems. However, as of October 29, Ubuntu and Red Hat had not yet released patches for their own versions.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)