5 ms·

- The OpenBSD one is 'TCP packets with invalid SACK options could crash the kernel' https://cdn.openbsd.org/pub/OpenBSD/patches/7.8/common/025_sack.patch.sig ht

by ollin 5mo ago

- The OpenBSD one is 'TCP packets with invalid SACK options could crash the kernel' https://cdn.openbsd.org/pub/OpenBSD/patches/7.8/common/025_sack.patch.sig https://cdn.openbsd.org/pub/OpenBSD/patches/7.8/common/025_s... - One (patched) Linux kernel bug is 'UaF when sys_futex_requeue() is used with different flags' https://github.com/torvalds/linux/commit/e2f78c7ec1655fedd945366151ba54fcb9580508 https://github.com/torvalds/linux/commit/e2f78c7ec1655fedd94... These links are from the more-detailed 'Assessing Claude Mythos Preview’s cybersecurity capabilities' post released today https://red.anthropic.com/2026/mythos-preview/ https://red.anthropic.com/2026/mythos-preview/, which includes more detail on some of the public/fixed issues (like the OpenBSD one) as well as hashes for several unreleased reports and PoCs.

qingcharles 5mo ago
That OpenBSD one is exactly the kind of bug that easily slips past a human. Especially as the code worked perfectly under regular circumstances. Looks like they've been approaching folks with their findings for at least a few weeks before this article.
- NickJLange 5mo ago
  While not entirely unrelated, Linux also had a remote SACK issue ~ 6 years back. So if this Mythos is just an expensive combination of better RL and the original source material, that should hopefully point out where we might see an uptick in work ( as opposed to a novel class of attack vectors).