Anthropic says Claude developed a working attack that allows full remote control of a Linux server over the internet without a password by exploiting CVE-2026-98432. Present since Linux 4.4, the use-after-free race-condition vulnerability is rated 9.8 out of 10 and requires less than an hour to analyze and another five minutes to execute a command with root privileges. Red Hat released fixes for RHEL 8, 9 and 10, while Debian, SUSE, Oracle Linux and Amazon Linux also shipped patches for some versions. Ubuntu still lists every release from 16.04 to 26.10 as vulnerable despite fixes being in progress for several versions, and Red Hat recommends updating the kernel or applying a temporary firewall rule that reduces exposure without fully preventing exploitation.
Source: Read the original article
