Anthropic has disclosed that its AI model Claude produced a working exploit for a critical Linux kernel vulnerability tracked as CVE-2026-98432, which carries a severity score of 9.8 out of 10. The flaw has existed since Linux version 4.4 and can allow an attacker to gain full root control of a Linux server over the internet without a password.
According to Anthropic's Oct. 27 research post, the exploit was generated by an unreleased internal model after initial prompting, as part of a broader test covering Chrome, Safari, Android, Windows, and Linux. The attack takes less than an hour to locate a hidden memory region and about five minutes to execute a command with root privileges. The underlying bug is a race condition described as reading a shredded sticky note: one part of the system discards data while another still uses it. A specially crafted message opening an internet connection can trigger it. Importantly, a failed race only fails the handshake without crashing the system, allowing attackers to retry indefinitely.
The demonstrated exploit requires a server exposing an MPTCP listener, a feature enabled by default in programs written in Go since Go 1.24. However, the Go Security Team warns the underlying bug is not specific to MPTCP. Red Hat released fixes for RHEL 8, 9, and 10 on Sunday, including RHSA-2026:93412, while Debian, SUSE, Oracle Linux, and Amazon Linux have shipped at least partial fixes. Ubuntu still lists every version from 16.04 to 26.10 as vulnerable, with fixes in progress only for 22.04, 24.04, 26.04, and 26.10; 20.04, 18.04, and 16.04 remain marked "Vulnerable" with no release date. Red Hat published a temporary firewall rule that reduces exposure but does not fully prevent exploitation.
For the crypto industry, the vulnerability matters because Linux servers underpin blockchain nodes, validators, exchanges, and other critical infrastructure. However, no specific cryptocurrency is directly named or affected by the disclosure itself.
