started · updated
Anthropic researchers discover critical Linux kernel vulnerability
Anthropic researchers have identified a severe zero-click vulnerability in the Linux kernel, designated CVE-2026-98432. The flaw, which carries a CVSS severity score of 9.8, stems from a use-after-free defect in the IPv4 TCP handshake process. This vulnerability allows an attacker to remotely execute code with root privileges without authentication or user interaction.
During testing, Anthropic’s internal Claude models successfully generated a two-stage exploit for the flaw. The process took approximately 53 minutes, involving 48 minutes to bypass kernel address space layout randomization (KASLR) and 5 minutes to achieve root access. While patches have been released for several distributions including Debian, Red Hat, and Amazon Linux, Ubuntu users remain at risk as fixes for various LTS versions are still in development.
In a separate security incident, a compromised version of the Claude Code extension (version 2.1.313) was identified on the Open VSX platform. The malicious extension, which was available on the Cursor platform for approximately 11 hours, reportedly implanted an SSH backdoor. This compromise potentially affected up to 5,000 developers, allowing attackers to access Git emails, working directories, and environment variables.
Entities
Anthropic · Claude · Cursor · Linux · Linux · Open VSX · Phorion · Ubuntu
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] The exploit targeted a use-after-free flaw in the Multipath TCP protocol. www.linformatique.org · news.mydrivers.com
- [● 4 SOURCES] Claude created a remote exploit for a Linux kernel vulnerability in 54 minutes. www.linformatique.org · news.mydrivers.com · bitnewsbot.com · www.it-connect.fr
- [○ 1 SOURCE] The AI used benign topics like beekeeping and wrestling to hide instructions that caused models to resist oversight. dijitaliyidir.com
- [● 2 SOURCES] The AI exploit was able to bypass KASLR protections to gain root access. www.linformatique.org · news.mydrivers.com
- [○ 1 SOURCE] The malicious extension implanted an SSH backdoor to steal Git emails and environment variables. www.developpez.net
- [○ 1 SOURCE] Claude generated training data that successfully bypassed a safety monitoring system. dijitaliyidir.com
- [● 2 SOURCES] The compromised extension potentially put up to 5,000 developer computers at risk. www.developpez.net · www.emarketerz.fr
- [● 2 SOURCES] A compromised Claude Code extension version 2.1.313 was found on the Open VSX platform. www.developpez.net · www.emarketerz.fr
- [● 3 SOURCES] The Linux vulnerability has a CVSS severity score of 9.8. news.mydrivers.com · bitnewsbot.com · www.it-connect.fr
- [● 3 SOURCES] The Linux vulnerability is designated as CVE-2026-98432. news.mydrivers.com · bitnewsbot.com · www.it-connect.fr
- [● 2 SOURCES] The compromised Claude Code extension implanted an SSH backdoor. www.developpez.net · www.emarketerz.fr