Anthropic says its internal Claude model produced a lab proof of concept for CVE-2026-98432, a Linux kernel IPv4 TCP use-after-free. The test targeted Linux servers with a Multipath TCP (MPTCP) listener and ran commands as root without credentials or user interaction, according to Anthropic’s account. In a bulletin updated November 5, AWS said it had no evidence the flaw had been exploited at that time and listed fixed Amazon Linux kernel packages.

What Anthropic’s lab test demonstrated

A use-after-free occurs when software accesses memory after it has been released. In this case, the flaw is in the Linux kernel’s IPv4 TCP connection handling. Anthropic described a proof of concept against a server with an MPTCP listener; its account says the exploit code was not published.

The listener condition is part of the specific setup Anthropic described. Its report does not make that a requirement for every possible attack on the underlying flaw.

What the 53-minute result means

Anthropic reported 48 minutes to leak a kernel pointer, followed by another five minutes to reach shell-command execution in its proof of concept. Those are two stages of its lab result, not a general estimate for how long an attack takes. Anthropic published its account on October 27, 2026.

Why containers still depend on the host kernel

A container image does not replace the Linux kernel running on its host. AWS makes that distinction in its CodeBuild security bulletin, which says Linux build hosts can be affected regardless of the build image because the kernel belongs to the host. For self-managed instances, a fixed kernel package must be installed and the host rebooted for the change to take effect.

AWS’s November 5 bulletin lists fixes for Amazon Linux 2 and Amazon Linux 2023 kernel packages. For Amazon Linux 2023 instances pinned to a release, AWS specifies release 2023.12.20261102 or later. The bulletin also says the host must reboot after the update.

Red Hat’s November 3 advisory covers a kernel update for RHEL 8.4 x86_64 under Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On. It lists kernel version 4.18.0-305.218.1.el8_4 and requires a reboot for the fix to take effect. Canonical announced on November 2 that fixes were available in Ubuntu’s -proposed pocket.