CVSS 9.8 Linux TCP bug: Anthropic says Claude wrote a working root exploit PoC
tobi · x · 2026-11-01
- Atlas Security disclosed CVE-2026-98432, a remote use-after-free in Linux's IPv4 TCP handshake scoring CVSS 9.8 (Critical). The bug dates back to Linux 4.4 and was fixed upstream on Oct 11/15 in a four-line change.
- Fixed lines include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3; as of Oct 31, Ubuntu and RHEL 8/9/10 still show "Vulnerable" with no fix shipped.
- The bug sits in code every Linux server runs when accepting IPv4 TCP connections, before any application sees the connection. Anthropic, whose researcher reported it, says Claude wrote a working PoC that executes commands as root on servers with a multipath TCP listener — no credentials needed; the Go Security Team notes Go programs open such listeners by default.
- Shopify CEO Tobi Lütke amplified the disclosure with "What a disaster."
Related event: Critical Linux TCP Flaw Enables Remote Root; Most Distros Unpatched(3 posts)→
More from Models
- DeepSeek V4.1F-1017 Hits 159 on Epoch Index, Matching GPT 5.5, 10 Points from Astra — teortaxesTex · 2026-11-02
- Domingos: If OpenAI and Anthropic Had a Secret Sauce, Distillation Wouldn't Work — pmddomingos · 2026-11-02
- AI commentator laments frontier labs leak nothing, not even model configs — teortaxesTex · 2026-11-02
- First GPT-6.1 Terra test: perfectly rebuilds a scanned PDF form in 81 seconds — MikePFrank · 2026-11-02
- Polymarket puts 69% odds on GPT-6 "Astra" launching within two weeks — Polymarket · 2026-11-02
- Gemini users report simple questions now get template refusals — kueowirnzcd · 2026-11-02