Anthropic revealed that a previously undisclosed Claude research model discovered and successfully exploited a critical Linux kernel flaw, tracked as CVE-2026-98432 This article explores explains tcp_v4_syn_recv_sock. . The exploit allows remote attackers to execute commands as root without requiring authentication or user interaction.
The flaw, which had already been patched upstream, was identified and reported by Anthropic's Frontier Red Team on October 27, 2026.
This pointer reveals the memory layout and circumvents Kernel Address Space Layout Randomization (KASLR), a defense mechanism that obscures where kernel code resides. The public record differs slightly from Anthropic’s description. The text mentions an IPv4 fix titled “free inet_opt and ireq_opt after an RCU grace period.” It explains that tcp_v4_syn_recv_sock() passes IP options to a child socket without copying them.
Another CPU can then process a repeated SYN and build a reply while the options are freed with a plain kfree(), leading to a use-after-free in ip_options_build(). A security blog lists fixed stable releases, including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, and 6.18.56, but readers should independently verify these numbers on kernel.org. At the time of writing, Ubuntu's page indicates that 22.04, 24.04, and 26.04 kernels are vulnerable, with work in progress for older versions like 20.04 and 18.04.
Linus Torvalds recently said Claude Code helped write Linux kernel patches, showing the same tools can benefit both builders and bug hunters.
