Critical Linux Kernel Vulnerability Discovered by AI Model

A critical vulnerability affecting nearly all Linux distributions has been uncovered in the network code of the Linux kernel, carrying a maximum severity rating of 9.8 under the Common Vulnerability Scoring System (CVSS). Tracked as CVE-2026-98432, the security flaw exists within the IPv4 TCP connection handling process and has remained hidden in the codebase for approximately eleven years.

The issue stems from a race condition categorized as a use-after-free error. During simultaneous TCP connection requests, an attacker can manipulate the Linux kernel to access memory on a central processing unit that another CPU has already released. This unexpected memory access can be coordinated to allow malicious actors to inject and execute remote code.

The vulnerability was discovered through systematic testing by artificial intelligence. Anthropic reported that its Claude model uncovered the defect and successfully created a functional exploit in a research environment, proving that unauthorized remote root command execution is possible on specific configurations. Anthropic subsequently reported the flaw to the Linux kernel team.

The faulty code was originally committed on October 2, 2015, and included in version 4.4 of the Linux kernel. Greg Kroah-Hartman confirmed that the flaw was addressed in kernel versions 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. The flaw specifically impacts IPv4 implementations, while IPv6 remains unaffected by the issue.

Response times and patch availability vary significantly across different Linux distributions. Debian, Oracle Linux, Amazon Linux, and SUSE have released updated packages for at least a portion of their supported kernels. However, as of late October, Ubuntu and Red Hat Enterprise Linux (RHEL) had not yet released finalized update patches, with their teams continuing remediation efforts.

Security advisories note that exploitation is currently linked to Multipath TCP (MPTCP) connections, an optional feature that requires explicit server activation. Although Anthropic's exploit is not publicly available, security agencies and researchers recommend that administrators apply patched kernels as soon as official updates become available from their respective software vendors, as no simple or reliable interim mitigation measures currently exist.