Critical Linux TCP bug found by Claude: update your kernel

A critical bug that sat in the Linux kernel's networking code for about 11 years has been fixed after Anthropic's Claude AI model found it, heise online reports. Tracked as CVE-2026-98432 with a CVSS score of 9.8, it can let an attacker run code on a Linux machine over the network.

What the bug is

The flaw is a race condition in the IPv4 TCP handshake. According to the kernel's CVE notice, when a retransmitted SYN packet is processed on one CPU while the connection is being set up on another, the kernel can read the connection's IP options after that memory has already been freed (a use-after-free). The code was added on Oct. 2, 2015, in kernel 4.4, so almost every distribution is affected. IPv6 is not, heise says.

The fix is small: the kernel now waits for an RCU grace period before freeing that structure. Greg Kroah-Hartman confirmed fixed versions on Oct. 15, including 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7, and the fix has been backported to older maintained long-term branches.

How dangerous is it?

Anthropic described the find in a research post on Claude's security work. After initial prompting, Claude wrote an exploit that lets a remote attacker run commands as root, with no login and no user interaction, on servers that have a Multipath TCP (MPTCP) listener. A lost race only fails one handshake rather than crashing the system, so an attacker can simply keep retrying; in Anthropic's proof of concept, leaking a kernel address took 48 minutes and getting a shell command to run took another five.

The exploit has not been published, and there are no reports of attacks in the wild. MPTCP is opt-in for most software, but LWN notes the Go security team advised on Oct. 29 that Go programs use Multipath TCP by default, so many servers may have such a listener without their admins knowing. Heise adds it is still unclear whether an MPTCP service is strictly required for an attack.

What to do

• Servers and PCs: install your distribution's kernel update (Debian, Red Hat, SUSE and Ubuntu have advisories) and reboot, since a new kernel only takes effect after a restart. uname -r shows the running version.
• Routers, NAS boxes and other Linux appliances: these depend on firmware from the vendor. Watch for updates; our guide on how to update router firmware explains how.

The case is another sign of how quickly AI models are changing security research, a theme also behind the recent Mistral Large 4 release with a cybersecurity focus.