What the bug is. When the kernel finishes a TCP handshake over IPv4, it hands the connection's IP options to the new socket without copying them. If that socket dies while another CPU is still using those options to answer a resent request, the kernel reads memory it already freed (a use-after-free). The bug dates back to Linux 4.4, and IPv6 is not affected. The kernel team rates it 9.8 out of 10. Red Hat, Oracle and SUSE score it 8.1 and Amazon 7.0, because they think the race is harder to win.
Why it matters. Anthropic's Oct 27 post says Claude wrote the exploit after initial prompting: first it leaks a kernel address to get past memory randomization (that took 48 minutes in its test), then it overwrites a pointer to run a root shell command (5 more minutes). A lost race only fails one connection, so an attacker can keep retrying without crashing the box. Anthropic's exploit targeted servers with a multipath TCP listener, a feature an app has to switch on, so most servers are less exposed than the 9.8 suggests. Still, an AI-built remote root on the world's most common server kernel, with the two biggest enterprise distros unpatched, is the scenario defenders have been warned about. No in-the-wild exploitation has been reported.
Who has a fix. Debian (trixie and bookworm), Oracle Linux UEK, SUSE Linux Micro 6.2 / openSUSE Leap 16.0 and Amazon Linux 2023 (kernel6.18 and kernel6.12) have shipped fixed packages. Ubuntu 16.04 through 26.10 are listed as vulnerable or work in progress. Red Hat says RHEL 8, 9, 10 and OpenShift 4 fixes are "deferred to a future update." Amazon Linux 2 and most SLES 15 branches are still pending.
What I'd do today. Find any internet-facing Linux service that uses multipath TCP and patch those hosts first, or turn MPTCP off where you don't need it (on most kernels, sysctl net.mptcp.enabled=0). Patch Debian, Oracle, SUSE Micro and Amazon Linux 2023 fleets now. For Ubuntu and RHEL, keep exposed TCP services behind a load balancer or proxy that ends the connection, and watch for unexplained kernel crashes on edge hosts until the vendor kernels land.