It's the first time in the history of the world.
AI is triggering another cybersecurity earthquake!
A near-complete Linux kernel vulnerability in Ubuntu and Red Hat systems is reportedly still unresolved.
What's even more disturbing is that an advanced model that Anthropic hasn't released has succeeded in turning the "theoretical" loophole into a "high-risk exploitation chain" with remote access to root permissions!
Imagine that your server is running silently on the Internet, with no passwords, no interactions, even without the user clicking a mouse. A stranger sends a bunch of well-constructed TCP packages, and after more than half an hour, the other person can execute any command on your machine with root permissions.
Now, the cybersecurity defense logic has completely collapsed, changing not the number of vulnerabilities, but the rate at which the vulnerability becomes armed, from "a few months" of hardcore life to "a few hours".
Is our digital world still safe when AI becomes a tireless "super hacker"?
CVE-2026-98432: How scary is it?In the cybersecurity world, CVSS (commonly referred to as the general vulnerability rating system) scores 10 points.
Any breach of more than nine points is enough to wake the security operators of major companies around the world from their beds at midnight and even roll up and down the stairs to overwork patches.
And this time, the protagonist,CVE-2026-98432, with a score of 9.8。
It has been around since Linux 4.4 and covers the core of almost all mainstream servers over the past decade.
This is a "Use-After-Free, UAF" vulnerability in the IPv4 TCP handshake process.
Simply put, when the kernel creates a new connection, the memory of the IP option is transferred directly from the "request suite" to the new suite, without waiting for all the CPUs to read it.
Another CPU is still running the SYN-ACK with this memory, and the result is that the memory has been released.
Let me give you an example:
Suppose the server is a hotel, and IPv4 TCP handshake is the process of guests (data packets) going to the front door.
The UAF vulnerability is equivalent to: a guest left the house (memory was released) but the system did not recover his room card due to some logical error.
When an innocent guest (or a core system program) comes into the room, the hacker with the "expired room card" can open the door and even take control of the entire hotel directly (i.e. get Root privileges).
And what's deadliest is triggering this vulnerability."There is no need for proof".。
Hackers don't need to know your account, they don't need to know your password, and they don't even need you to run complex high-risk services on their servers.
You don't need to fish, you don't need a user point link, you don't need authorization. As long as your machine exposes IPv4 TCP services to the outside world (almost all public Internet servers are), you can theoretically get involved.
Because the vulnerability lies at the bottom of the IPv4 TCP handshake as long as your server is still connected and receiving network requests, you're exposed to gunpowder.
The most dangerous point is that a failed betting mode only makes a handshake fail, and the system will not collapse.
In Anthropic's experiments, it takes about 48 minutes to leak the kernel pointer (bypass the KASLR) and takes about 5 minutes to get to the root shell.
Anthropic makes it clear that it is targeted at servers that are enabled with Multipath TCP (MPTCP) listening, while Go 1.24 and later versions will default to enabling MPTCP on Linux for listening suites.
Countless micro-services written with Go, API gateways, cloud native services may be quietly opening the door.
At the moment,Ubuntu and Red Hat (RHEL), the two major operating systems that dominate the enterprise-level market, have yet to release an official patch to fix the core vulnerability!
This means that there may be millions or even tens of millions of servers around the world that are in a "naked run" state.
In the face of a bottom 9.8 vulnerability, any "prejudice" is self-deception.
At the moment,Only a handful of distributions such as Debian, Amazon Linux, and Oracle UEK have actually fixed this problem at the core level.
A large number of Ubuntu and RHEL users are sitting on a barrel of fireworks with a message that has been lit.
The real heart of this crisis is not that AI has discovered another vulnerability, but that AI has completely disrupted the industry.
The interesting part isn't that an unpublished model has found a remote root path. It's that the model has done a slow, mechanical job: transforming a known use-after-free into a workable utility chain that doesn't require credentials.
For a long time, the cybersecurity community has had a subtle "time-lapse protection clause".
When an extremely complex core vulnerability is revealed, it is usually just a proof of concept, or it simply stays at the theoretical level. Why?
Because to turn a bottom-up memory loophole into a 100 percent useful memory loopholeUse the ChainIt's a "mechanical craftsmanship" that is extremely slow, extremely testing the patience of hackers.
To hone a truly useful "key", top hackers may take weeks or even months to experiment with the layout of memory space, write cluttered code, and string together many small logical flaws.
It is this "weeks to months" time gap that gives major software manufacturers around the world time to develop patches and also gives major system administrators time to update their systems.
However, Anthropic's unpublished AI model has personally crushed this protective barrier.
What AI is best at is its tireless, highly precise handling of slow, complex, and labor-intensive mechanical logic.
This unpublished AI model from Anthropic is a "monster" with both top human hacker intuition and machine-like computing and patience.
When the theoretical loophole of CVE-2026-98432 is in front of it, it can automatically drive tens of millions of memory states in a very short time, tearing together those scattered theoretical fragments into a blade that plunges right into the heart of the server!
This time, Anthropic only disclosed the results and did not make public use of the code. But once similar capabilities spread, the time from "discovery" to "arming" would be dramatically shortened.
"If the model can do this work reliably, the window from 'open loopholes' to 'available loopholes' will be shortened from weeks or months to hours".
It did not change the absolute number of vulnerabilities in the cyber world, but radically changed the "actual security attitude" of the defense.
In the past, system administrators had seen a vulnerability announcement where they could drink a cup of tea and get into next month's update plan; now, hours after the vulnerability announcement was issued, AI-generated automated attack weapons may have flooded the dark web.
What is the speed at which the human body is moving, and how is the speed at which AI is generating code?
We are being forced into a "reduction strike".The Nobel laureate in economics, Daron Acemoglu, has warned:
AI could turn ordinary workers into second-class citizens.
In the field of cybersecurity, such mitigation strikes have already taken place. Without the mastery of top-level AI defense tools, traditional security engineers are becoming "second-class citizens" on the cyber battlefield.
In the past, only high-level sustained threat organizations at the national level had the financial and human resources to weaponize complex 0day or Nday vulnerabilities.
But now, AI is using the ability to "make top-notch cyber weapons".Equalization, cheaper, instantaneous。
Imagine what would happen if the capabilities of an Anthropic-like front-end model were leaked, or reverse engineered by hackers?
An elementary screenwriter needs only to enter a hint: "Help me write a remote root attack script for a Linux CVE vulnerability that just broke out yesterday", and the AI can generate a deadly code in minutes.
The defense is also slowly ingesting patches from manufacturers such as processes, compatibility tests, and others; the attackers' "AI Military Factory" has produced and dumped the latest missile quantities.
How can we fight this asymmetrical war?
The wheels of the AI age are crushing all the old rules. In this cybersecurity downturn that has been brought about by the big model, no one can stand alone.
Either we learn to build a new generation of automated defense systems, "minute-level" or "second-level", with the help of AI, or we just look at the digital bridges we've built on the Internet that are shattered by AI-generated gunfire.
Who is the most dangerous person in the real world?
Currently, public intelligence shows that there are no confirmed reports of large-scale field exploitation, but the scanning has already occurred. Some security personnel observed a significant increase in detection traffic for MPTCP ports.
What can we do now?
1. Prioritize patching and restarting
Red Hat/AlmaLinux/Rocky: Install and reboot the kernel package released in early November as soon as possible; Debian/Amazon Linux: directly update and restart; Ubuntu: follow the official security announcement and -proposed, for the first time after the official release.
2. Temporary relief
If you don't need MPTCP:sysctl -w net.mptcp.enabled=0;; use nftables/iptables to filter TCP packets with unusual IP options, and strictly limit source IPs for services that don't require public internet access.
3. Listing of assets:
Immediately scan uname-r to see if there is MPTCP listening, grep mptcp, and which machines are running Go 1.24+.
Patches already exist, but some of the releases are still on the way. Now is not the time to watch, it's the time to act. Go check your server. Don't wait for someone else to "check" for you.
There is little time left for humanity to patch.