Linux Kernel TCP/IPv4 Flaw Exploited via Claude-Built Payload
A critical 22-year-old kernel bug gets a zero-click exploit courtesy of an experimental AI model, catching Go apps and default Linux configs off guard.
A critical vulnerability carrying a maximum CVSS score of 9.8 has been uncovered in Linux kernel versions dating all the way back to version 4.4. Tracked as CVE-2026-98432, the flaw involves a race condition and use-after-free in TCP/IPv4 processing.
Anthropic used an experimental Claude model to assemble a functional zero-click exploit capable of unauthenticated remote root command execution. The demonstration leveraged an MPTCP listener, with the full exploitation process taking about 53 minutes to bypass KASLR and hijack kernel control.
The complication arises because, starting with Go 1.24, MPTCP is enabled by default for TCP listeners on Linux. This means applications can use MPTCP unknowingly, and popular networking tools like node_exporter are affected. The Go team has already issued a security advisory.
While the core vulnerability lies in TCP/IPv4 rather than MPTCP itself, disabling MPTCP mitigates the specific demonstrated attack vector. Administrators can check listeners using ss -Mntlp, temporarily disable MPTCP for Go applications via GODEBUG=multipathtcp=0, or adjust system settings with sysctl -w net.mptcp.enabled=0. However, this per-netns adjustment leaves container namespaces at default settings.
Fixes are already available in upstream and stable branches, though Ubuntu and RHEL had not yet released patched kernel packages as of October 30.
Source: habr
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.