Red Hat, Ubuntu Lack Fix for Linux Flaw Claude Exploited

Red Hat lists Red Hat Enterprise Linux 8, 9 and 10 as “Affected” by CVE-2026-98432, with no fix issued, and rates the flaw Critical with a CVSS score of 9.8, according to its CVE page on 30 October. Ubuntu’s page lists its supported releases as “Vulnerable”.

This is the Linux kernel flaw that Anthropic says an unreleased Claude model turned into a working exploit. The CVE was made public on 15 October; Debian shipped its fix the next day. That leaves Red Hat and Ubuntu 15 days without a fix, by our arithmetic.

Short explainer · Red Hat, Ubuntu: 15 Days, No Fix for Linux Flaw Claude…

A vertical news Short narrated from this piece’s headline and opening line.

Business Pill · LEAST PRIVILEGE

A short Business Engineer explainer on least privilege: giving software only the access its task needs. It teaches the general idea only and says nothing about Linux, Anthropic or any company in this piece.

What Anthropic Said

In a post on 27 October, Anthropic said it used “an unreleased, internal research model” to find critical vulnerabilities in widely used software. It said Claude wrote an exploit that lets a remote attacker run arbitrary commands as root on Linux servers with a multipath TCP listener, “without any credentials or user interaction”.

Anthropic wrote that the vulnerability “was patched upstream and backported to all maintained stable kernel branches”. We covered the wider post, including its Chrome findings, in our earlier piece.

What Was Posted on X

International Cyber Digest says an unreleased Claude model turned a Linux kernel bug into a remote root exploit, that Ubuntu and Red Hat still lack a patch, that Anthropic says the exploit runs commands as root on servers with a multipath TCP listener with no login needed, and that Debian shipped its fix on 16 October.

Where Each Distribution Stands

Debian’s tracker shows the flaw fixed in the security updates for its bookworm and trixie releases. Its security advisory DSA 6568-1, a linux security update dated 16 October, lists the CVE.

Red Hat’s page lists the kernel in Red Hat Enterprise Linux 8, 9 and 10 as Affected, with no errata. It lists Red Hat Enterprise Linux 7 as “Not affected”. OpenShift Container Platform 4 and 5 images are also listed as Affected.

Red Hat says Affected means “a fix may be released to address this issue in the near future”. On workarounds, it says: “Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria”.

Ubuntu lists 26.04, 24.04 and 22.04 LTS as “Vulnerable”, with “work in progress” on kernel updates, and 20.04, 18.04 and 16.04 as Vulnerable. It lists 14.04 as “Not affected”.

Who Is Exposed

By Anthropic’s description, the exploit targets Linux servers with a multipath TCP listener and needs no login. Servers running the affected kernels without such a listener are outside the scenario Anthropic described; the vendors’ pages above remain the reference for each system.

Anthropic says it reports flaws under a coordinated disclosure policy, “which gives developers 90 days to patch and a further 45 days before we discuss details beyond what is already included in a public advisory”.

The Structural Read

As we read the vendor pages, the gap is in distribution, not upstream: Anthropic says the flaw was patched upstream and backported to all maintained stable kernel branches, while Red Hat and Ubuntu list their kernels as Affected or Vulnerable.

As we read Red Hat’s page, there is no interim workaround it endorses: it says mitigation is either not available or does not meet its Product Security criteria.

As we read Anthropic’s description, exposure depends on a specific configuration: the exploit it describes targets Linux servers with a multipath TCP listener.

Three Implications

FOR RED HAT ENTERPRISE LINUX FLEETS Red Hat lists RHEL 8, 9 and 10 kernels as Affected with no errata, and OpenShift Container Platform 4 and 5 images as Affected.

FOR UBUNTU SERVERS Ubuntu lists 26.04, 24.04 and 22.04 LTS as Vulnerable with work in progress on kernel updates.

FOR DEBIAN SERVERS Debian’s tracker shows the flaw fixed in the security updates for bookworm and trixie, via advisories including DSA 6568-1 of 16 October.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The analysis describes the governance layer this way: “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”

As we read it, Anthropic keeping this model unreleased while vendors patch is that layer at work: the company says it used an unreleased, internal research model and reports flaws under a coordinated disclosure policy. The analysis was published in June 2026; it does not discuss this flaw or the Linux distributions.

What Is Not Established

Neither Red Hat nor Ubuntu gives a date for a fix on the pages we read, and none of the vendor pages we read reports the flaw being exploited outside Anthropic’s research. Statuses change as updates ship; the pages were read at about 20:15 UTC on 30 October.

Anthropic does not say how many internet-facing servers run a multipath TCP listener, and we have not estimated it.

The Bottom Line

Fifteen days after CVE-2026-98432 went public, Red Hat lists Red Hat Enterprise Linux 8, 9 and 10 as Affected with no fix, and Ubuntu lists its supported releases as Vulnerable, while Debian patched on 16 October. Anthropic says an unreleased Claude model turned the flaw into a remote root exploit on servers with a multipath TCP listener.