CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue
Bulletin ID: 2026-160-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/30/2026 22:15 PM PDT
Summary:
AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third party could send crafted IPv4 TCP packets to an affected listener, resulting in unauthenticated remote code execution. We will update this bulletin as more information becomes available.
Current Mitigation Status:
Amazon Linux
Amazon Linux 2 and Amazon Linux 2023 kernel packages for the resolution of CVE-2026-98432 are available. Customers should update their kernel packages and reboot. Kernel versions kernel-4.14, kernel-5.10, kernel-5.15, kernel-5.4, kernel-6.1, kernel-6.12, & kernel-6.18: Updated in ALAS2023-2026-3251 (version 6.18.56-125.164). Available now. All kernels above: Updated in ALAS2023-2026-3335. Available now.
To update:
|
# Amazon Linux 2 # Amazon Linux 2023 |
Amazon EC2
Customers running self-managed Linux instances on Amazon EC2 are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.
After updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.
AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway
The customers using above services don't receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self managed instances behind these services with in the next 30 days.
Network Load Balancer (TCP Listeners) and Amazon Global Accelerator
Customers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
Amazon EKS
Amazon EKS has released updated EKS-optimized Amazon Linux 2023 AMIs for Kubernetes version 1.33 and later (release v20261026) that address this issue. Customers using managed node groups, self-managed nodes, or Karpenter with these AMIs should update their nodes to v20261026 or later. We expect to complete the global release of the updated Auto Mode AMI by November 06, 2026. No customer action is required for Auto Mode. Amazon EKS Auto Mode will automatically replace existing nodes with an updated AMI that includes the patched kernel, subject to NodePool disruption budgets.
Amazon ECS
Customers running Amazon ECS on EC2 instances should update the kernel on their container instances as described above and reboot. For customers using AWS Fargate & ECS Managed Instance, AWS is applying updates to the underlying infrastructure. No customer action is required for Fargate & ECS Managed Instance tasks.
Bottlerocket
Updated Bottlerocket AMIs with the patched kernel are expected to be available beginning November 02, 2026. We recommend customers update to the latest Bottlerocket AMI when available.
AWS Lambda
Lambda workloads are not affected by this issue CVE-2026-98432 requires an actor to send a specially crafted network packet to a publicly reachable IPv4 TCP port on an affected host. Lambda functions do not expose public IPv4 TCP ports, so there is no path for an external party to reach your function's execution environment with the type of traffic needed to trigger this issue. No action is required on your part.
As a defense-in-depth measure, we are proactively applying the kernel patch to the Lambda service infrastructure.
Amazon Lightsail
Customers running self-managed Linux instances on Amazon Lightsail are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.
After updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.
VPC Endpoints (PrivateLink)
Customers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
VPC Lattice
Customers running Layer 4 targets (SRE, SNE) environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
RDS / Aurora
RDS / Aurora customers need to make sure that the database ports are not exposed from the internet.
Neptune
Neptune customers need to make sure that the database ports are not exposed from the internet.
Interim step for customers who cannot update immediately
Disable MPTCP by setting the kernel parameter net.mptcp.enabled=0, or set GODEBUG=multipathtcp=0 for applications built with Go 1.24 or later. This step reduces the conditions for running code on a host, but it does not resolve the issue. Updating the kernel and rebooting, or applying a livepatch, resolves the issue
Customers can disable IP Options to mitigate this with an IP tables rule. An example is provided below:
| iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP |
References:
Please email aws-security@amazon.com with any security questions or concerns.