Anthropic Exploits Critical Linux Kernel Flaw to Gain Remote Root on MPTCP Servers

Anthropic researchers developed an exploit for CVE-2026-98432, a use‑after‑free in the kernel's IPv4 TCP code with a 9.8 severity score, affecting Linux kernels from version 4.4 including Ubuntu, RHEL and Rocky Linux. The exploit enables unauthenticated remote code execution as root on servers running Multipath TCP listeners, though RCE on plain TCP has not been publicly demonstrated.