Source: Anthropic Frontier Red Team
A critical Linux kernel vulnerability with an unusual pedigree is testing how fast European infrastructure teams can patch. CVE-2026-98432 is a use-after-free race condition in the kernel’s IPv4 TCP connection handling, present in the code since Linux 4.4 and rated 9.8 out of 10 by the Linux kernel CVE team. Anthropic’s Frontier Red Team has now demonstrated just how dangerous it is: an unreleased internal AI research model wrote a working exploit that turned the bug into remote root access on servers running Multipath TCP (MPTCP) listeners, without credentials or any user interaction.
What the research actually showed
In research published on 27 October 2026, Anthropic described how its model chained the flaw in the lab, first leaking a kernel pointer to defeat address space layout randomization and then running an attacker-chosen command as root. The whole chain took roughly 53 minutes. The exploit code has not been published, and there are no confirmed reports of exploitation in the wild. But the message is clear: the ability to build sophisticated exploit chains is no longer reserved for a handful of specialist teams, and the time between a disclosure and weaponization keeps shrinking.
The flaw was fixed upstream on 5 October 2026, and patched kernels have reached all maintained stable branches. Distribution coverage is uneven, however. Debian shipped fixes in 6.1.190-1 and 6.12.113-1, but as of 30 October 2026 Ubuntu and Red Hat Enterprise Linux had not yet released fixed kernels. Services built with Go 1.24 or later may open MPTCP listeners by default, which raises exposure, although the underlying bug affects regular IPv4 TCP handling regardless.
What European operators should do
Check kernel versions across your fleet, especially on internet facing Linux hosts that accept TCP connections from untrusted networks, whether they run on Hetzner, AWS, Azure, DigitalOcean or your own hardware. Apply vendor patches as soon as they land, and where fixed kernels are still missing, consider interim measures such as disabling MPTCP, which reduces the likelihood of triggering the race, and restricting which hosts are reachable. Treat configuration changes as temporary exposure reduction, not as a substitute for patching.
This episode is also a planning prompt: if a critical kernel bug can appear with an AI-generated remote root proof of concept attached, your patch lead times matter more than ever.
Need a structured vulnerability audit or faster patch pipeline for your infrastructure? Contact the team at Excello Digital for professional advice and hands-on support.