Ubuntu hasn’t released its fix for the Linux bug Claude exploited. What to update

Ubuntu hasn’t released its Linux fix

Of the five exploit chains Anthropic’s unreleased model wrote, the Linux one is still open on many servers. CVE-2026-98432 is in the Linux kernel’s IPv4 TCP code, present in every kernel from 4.4 on, and rated 9.8 out of 10. Anthropic’s post says it “was patched upstream and backported to all maintained stable kernel branches.” Most servers don’t run those kernels, though. They run their distribution’s, and on November 3, Ubuntu’s still wasn’t out.

Ubuntu’s CVE page, updated November 3, lists every supported release as “Vulnerable,” the newer ones with work in progress. Canonical’s post on the fix says the kernels for 22.04 LTS and newer are in the -proposed pocket while it tests them “on more than 2,000 certified servers and devices,” and that it will move them to the updates pocket “as soon as those tests are complete.” It gives no date. For 16.04, 18.04 and 20.04: “A fix for older, still supported Ubuntu releases will follow.”

Here is where the fix stands on November 3:

System	Kernel with the fix	Status
Ubuntu 26.04 LTS	7.0.0-43.43	In testing, in -proposed
Ubuntu 24.04 LTS	6.8.0-149.149	In testing, in -proposed
Ubuntu 22.04 LTS	5.15.0-203.213	In testing, in -proposed
Ubuntu 16.04, 18.04 and 20.04	None yet	Pending
Debian 13	6.12.113-1	Released, DSA-6568-1
Debian 12	6.1.190-1	Released, DLA-4841-1
Red Hat Enterprise Linux 8, 9 and 10	4.18.0-553.182.1, 5.14.0-687.64.1 and 6.12.0-211.72.1	Released November 1
Amazon Linux 2 and 2023	Kernels 4.14, 5.4, 5.10, 5.15, 6.1, 6.12 and 6.18	Released

For Ubuntu 26.10, which isn’t a long-term release, Canonical’s post says “Fixed in 7.3.0-10.10” while its CVE page still says work in progress. Red Hat’s CVE page lists its fixed kernels in advisories such as RHSA-2026:93412 for RHEL 9, though its bulletin, last updated November 2, still says Red Hat “is expediting the release of fixes.” Debian’s are in its security tracker. AWS’s bulletin has the Amazon Linux commands, and says plainly that “Canonical has not yet released a fixed kernel for Ubuntu.”

Who is exposed: Red Hat says the bug “affects any system running a vulnerable kernel version with IPv4 TCP networking enabled,” and that “Systems accepting inbound TCP connections are most directly exposed.” AWS says crafted packets “that carry IP options” sent to an affected listener “could result in a kernel crash, disclosure of kernel memory, or memory corruption,” and that researchers have shown remote code execution on hosts with a multipath TCP listener. AWS has “no evidence that this issue has been leveraged at this time,” and Canonical says “no other exploit is known to have been generated or published.”

On Ubuntu, then:

1. Check what you run. Canonical’s commands: uname -r for the running kernel, and dpkg -l 'linux-image*' | grep ^ii for the installed ones. Compare them with the table.
2. Install the fixed kernel the day it’s released, and reboot. A new kernel protects a server only once it’s running. “A kernel update and reboot is the only complete remediation for this issue,” AWS says. Canonical’s pages don’t say whether Livepatch, its service for patching a running kernel, will carry this fix.
3. Or test the -proposed kernel now, if you can. Canonical offers it to “users who run their own kernel acceptance tests,” with the commands below.
4. On 20.04 or older, the fix will come through Ubuntu Pro’s Expanded Security Maintenance, which Canonical says is “free for up to 5 machines,” and 16.04 needs its Legacy add-on as well. The fix for those releases is still pending.

Canonical’s commands for the -proposed kernel, for a kernel installed through a meta-package:

sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu
sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade
sudo reboot

“Packages from the -proposed pocket are not selected for upgrade by default,” Canonical adds, so the rest of the system stays on released packages.

Until then: filter packets, and what multipath TCP has to do with it

Red Hat’s bulletin and Ubuntu’s CVE page publish the same stopgap: an nftables table that drops incoming IPv4 TCP packets carrying IP options. Red Hat’s version, saved as cve-2026-98432.nft:

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

Check it with sudo nft --check --file cve-2026-98432.nft, apply it with sudo nft --file cve-2026-98432.nft, and once the fixed kernel is running, remove it with sudo nft delete table inet cve_2026_98432. Red Hat says the rule “reduces exposure to this vulnerability but cannot fully prevent it,” and to test it outside production first. “Ordinary application traffic is generally expected to remain unaffected,” it adds, because TCP’s own options travel in the TCP header. Ubuntu’s notes spell out the cost: the rule breaks “TCP connections that depend on IPv4 options,” containers with their own networking need it applied separately, and it lasts past a reboot only if you include it from /etc/nftables.conf, which Ubuntu’s page shows how to do on servers that don’t use UFW or firewalld.

Then there’s multipath TCP. Anthropic’s exploit targets “Linux servers with a multipath TCP listener,” so some advice says to switch multipath TCP off. AWS lists that as an interim step, “setting the kernel parameter net.mptcp.enabled=0, or set GODEBUG=multipathtcp=0 for applications built with Go 1.24 or later,” and says it “reduces the conditions for running code on a host, but it does not resolve the issue.” Canonical and Red Hat are firmer. “The CVE fix is not specific to MPTCP,” Canonical writes, and “The Ubuntu Security Team believes that security updates are the only appropriate mitigation.” Red Hat says “Multipath TCP is not a required condition for this flaw,” and that OpenShift nodes “in their default configuration, where MPTCP is disabled, remain affected.” So switching it off is a partial step at best: it gets in the way of the route Anthropic’s exploit took, and leaves the bug in place.

Behind a load balancer, it depends on which kind. AWS says servers behind its Application Load Balancer, CloudFront or API Gateway “do not receive TCP connections from untrusted sources directly when following best practices,” though it still recommends updating them within 30 days. Network Load Balancer TCP listeners, on the other hand, “pass client packets, including IP options, to targets,” so Linux servers behind those need the fix or the filter now.

What Anthropic says Claude did

On October 27, 2026, Anthropic’s Frontier Red Team published five attack chains written by “an unreleased, internal research model.” An attack chain strings several flaws together, each one getting past a layer of protection, until the attacker has what they came for: their code running on your computer, your data, or your server down. Each of the five starts the same way in Anthropic’s telling: “After initial prompting, Claude wrote” the exploit.

Anthropic reported every flaw under its coordinated disclosure policy, “which gives developers 90 days to patch and a further 45 days before we discuss details beyond what is already included in a public advisory.” So each chain was fixed before it was described. The Hacker News sums it up: the exploits “were built in the lab after the model was prompted, not seen in any real attack.”

What’s new is who can do this work. Anthropic says these skills “have historically been the domain of few specialist teams with expertise in these targets.” And: “Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.”

The five chains, and where each was fixed

Target	What the exploit did	What it needed	Fixed in
Chrome	Ran the attacker’s code outside Chrome’s sandbox	Opening a web page	Chrome 156, October 20
Safari	Let any website read other sites’ data, signed-in email included	Opening a web page	iOS, iPadOS, macOS Tahoe and Safari 26.5.2, June 29
Android	Copied photos and personal data off a locked Pixel 9	The phone, over USB	“Addressed by Google,” no version given
Windows	Crashed the machine with a few packets, again and again	A server answering HTTP/3	April 2026 updates, CVE-2026-33096
Linux	Ran commands as root, with no login	A server with a multipath TCP listener	Stable kernels, CVE-2026-98432; Ubuntu’s still in testing

Chrome. Four flaws in a row: one in V8, Chrome’s JavaScript engine, that let a page corrupt memory; a second to escape V8’s sandbox; a race condition in CacheStorage that revealed the layout of Chrome’s privileged browser process; and a use-after-free in FedCM, Chrome’s federated sign-in feature, to run code outside the sandbox. The proof of concept “launches the Calculator app from a stock default-configuration Chrome browser on macOS within seconds of the page loading, without any further user interaction.” Anthropic says Google assigned 62 CVEs to its reports, all critical or high and “patched as of Chrome 156,” including 13 sandbox escapes. Chrome 156’s release notes, from October 20, credit 15 of its fixes to Xinyang Ge, one of the post’s authors, five of them “(Anthropic), assisted by Claude.” Four more in the same release are credited to OpenAI Codex Security.

Safari. A use-after-free in JavaScriptCore, Safari’s JavaScript engine, a way out of WebKit’s Gigacage, and a flaw in the WebContent sandbox let the exploit read Safari’s history, cookies and session databases, then switch off the same-origin policy, the rule that keeps one site from reading another’s data. Anthropic’s example: “if the user is signed in to their email account, the attacker can now read their email.” It never ran code of its own; Anthropic calls it “a data-only attack.” Apple fixed it on June 29, 2026, in iOS and iPadOS 26.5.2, macOS Tahoe 26.5.2 and Safari 26.5.2 for macOS Sonoma and Sequoia, each crediting a WebKit use-after-free, CVE-2026-43715, to “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”

Android. Testing on a physical Pixel 9, the model found that a USB host with a specific setting got a locked phone to transfer data, skipped the pairing authorization check, skipped the six-digit code check so the phone “behaved as if the user had tapped ‘Allow,’” and pulled file contents through a fallback that a hardcoded check didn’t cover. Anthropic says only: “This issue has been addressed by Google.” It gives no update or patch level, and The Hacker News found no public record of the fix.

Windows. An out-of-bounds read in the Windows kernel’s QUIC code, the transport under HTTP/3. An attacker could “send a few packets of data to a listening server to crash and restart the machine,” and keep doing it. Anthropic estimates “there are likely several million such servers listening on the internet.” Claude found it by reverse-engineering the Windows binary with tools such as Ghidra, and Microsoft fixed it as CVE-2026-33096.

Linux. The exploit lets a remote attacker “send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or user interaction.” A lost race “only fails the handshake without crashing the whole system,” so an attacker can retry until it works. Anthropic’s proof of concept took 48 minutes to leak a kernel pointer and five more to run its command as root.

What to update

1. Chrome: 156 or newer. Open Chrome’s menu, choose Help, then About Google Chrome, and relaunch when it asks. The current desktop release, from October 29, is 156.0.8078.79 on Linux and 156.0.8078.79 or .80 on Windows and Mac. Chrome for Android carries the same security fixes as the desktop release it matches.
2. iPhone and iPad: iOS or iPadOS 26.5.2 or newer, from Settings, General, Software Update. Apple’s current releases, iOS 27.2 and 26.7.2 from October 26, are newer still.
3. Mac: macOS Tahoe 26.5.2 or newer, or Safari 26.5.2 or newer on macOS Sonoma and Sequoia.
4. Android: install the newest security update your phone offers. No one has said which one carries the fix.
5. Windows: April 2026’s updates or later. The CVE-2026-33096 record lists Windows 11 23H2, 24H2, 25H2 and 26H1, and Windows Server 2022, 2022 23H2 and 2025. Windows 11 24H2 is fixed from build 10.0.26100.8246, and Windows Server 2025 from 10.0.26100.32690. Microsoft rates it 7.5 out of 10, high.
6. Linux servers: a kernel with the fix, then a reboot. The CVE-2026-98432 record marks kernels from 4.4 on as affected and lists the first fixed release in each stable branch: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, and every release from 7.3. Run uname -r to see yours. Distributions backport fixes under their own version numbers, so check your distribution’s advisory for the CVE: Debian, Red Hat Enterprise Linux and Amazon Linux have released theirs, and Ubuntu’s are still in testing, as the first section shows. Reboot into the new kernel. The kernel’s own rating is 9.8 out of 10, critical.

Desktop apps built on Electron carry their own copy of Chromium and update on their own schedule, separately from Chrome. Electron 45.2.1, released October 31, is on Chromium 156.0.8078.75. Electron 44.10.1, from the same day, stays on the Chromium 152 that 44.10.0 moved to, and “Backported fixes from upstream Chromium, Dawn, Skia and V8” without saying whether they include the ones for Anthropic’s chain. Update the desktop apps you use, coding agents’ apps among them, when they offer it.

The records don’t quite match Anthropic’s descriptions

Two public CVE records describe the bugs differently than Anthropic does, a gap The Hacker News pointed out:

• Windows. Anthropic describes an out-of-bounds read “in the Windows kernel’s implementation of QUIC.” The CVE-2026-33096 record is titled “HTTP.sys Denial of Service Vulnerability,” describes an “out-of-bounds read in Windows HTTP.sys,” and credits no finder.
• Linux. Anthropic describes a race in the kernel networking stack reached through a multipath TCP listener. The CVE-2026-98432 record is titled “ipv4: free inet_opt and ireq_opt after an RCU grace period” and describes a use-after-free while the kernel’s IPv4 TCP code sends a reply during connection setup. It adds that “IPv6 is not affected by the first issue.” Anthropic’s post is what ties the two together.

Neither difference changes the fix, and both records rate the bugs high or critical. The Linux one matters for the stopgaps, though: Canonical and Red Hat both say the bug doesn’t need multipath TCP, the route Anthropic’s exploit took, so switching multipath TCP off doesn’t make a server safe.

Which model was it, and can you use it?

Anthropic doesn’t say. It gives the model no name and no release date, and doesn’t say how much a person did beyond “initial prompting” or how much compute the work used.

Its registration statement, the filing for its IPO, says Anthropic “recently chose to delay pre-training a new frontier base model for more than a month” for security work, and that “future Anthropic models exhibiting such capabilities may be subject to access constraints,” meaning advanced capabilities in finding cyber vulnerabilities. Neither the filing nor the post ties that model to this one. Our memo on the filing has the rest. Google is gating its newest model the same way: Gemini 4 Carbon goes to cyber defenders first.

What you can use today:

• Claude Opus 5.5, Sonnet 5.5 and Fable 5.1, the generally available models. They “have conservative cyber safeguards that block most cyber work,” Anthropic says, but “can continue to be used for tasks such as code review, patching known issues, vulnerability finding in owned source code, and triage of security alerts.”
• The Cyber Verification Program, which relaxes those safeguards for vetted security professionals and includes Claude Mythos 5.1. Defense Access is for defensive work, and Anthropic aims to answer “within a few days.” Red Team Access is for organizations only and takes “a few weeks.”
• Claude Security, in public beta for Claude Enterprise, which scans connected repositories with Claude Mythos and suggests patches, “with no Cyber Verification Program access required.”
• OSS Scanner, launched October 8, which gives open-source projects free scans by “our strongest models (including Claude Mythos).” Its reports aren’t reviewed by people, so some may be wrong.

Scan your own code

Anthropic’s advice to defenders: “scanning your own code is more important than ever.” Fixing old bugs, it adds, “only solves half the problem”; the other half is stopping new ones, so it scans “at PR time” and has released the Claude Code plugin it uses for that, security-guidance. In Claude Code:

/plugin install security-guidance@claude-plugins-official

It needs Claude Code 2.1.144 or later and Python 3.8 or later, and works in three layers:

1. Pattern warnings as Claude edits, for about 25 dangerous patterns such as pickle.load on untrusted data or raw innerHTML.
2. A review of the diff when Claude finishes a turn, on the newest Opus by default, which sends high-severity findings back to Claude “so it can fix them before you see the response.”
3. A review on git commit that reads related files to catch problems that span several, such as an auth bypass.

The reviews send the changed code, and any files the reviewer reads, to the model endpoint your Claude Code uses, on your Claude Code sign-in, an API key or your cloud provider. SECURITY_GUIDANCE_DISABLE=1 turns the plugin off, and ENABLE_COMMIT_REVIEW=0 turns off just the commit review.

For a sweep of everything, not just each change, an agent can work on a schedule. Enjoy runs Claude Code beside Codex and the other labs’ agents, each on the plan you already have, and a scheduled workflow can have one of them review the week’s changes for security problems every Friday night, on your own computer. Enjoy runs scheduled work only while the computer is awake and Enjoy is open. It’s a monthly subscription, with the first seven days free (pricing). Our guide to running Claude Code on a schedule compares the other ways, Anthropic’s own included.

What Anthropic and Canonical haven’t said

• The model’s name, and whether or when it will be released.
• How much people did at each step beyond “initial prompting,” and what the work cost.
• Which Android update fixed the Pixel chain.
• Which Chrome releases carried the rest of the 62 CVEs. Chrome 156’s notes credit 15 fixes to Anthropic’s researcher.
• Why the public records describe the Windows and Linux bugs differently from its post.
• When Ubuntu’s fixed kernels will be released, for 22.04 and newer or for 16.04 to 20.04. Canonical says only that it will release them once its tests are complete.
• Whether Livepatch will carry the Linux fix. Neither Canonical’s post nor its CVE page mentions it.

We’ll update this memo when Ubuntu releases its kernels, if Anthropic names the model, or if Google publishes the Android fix.