CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue
Bulletin ID: 2026-160-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/30/2026 22:15 PM PDT
Last Updated Date: 10/31/2026 17:15 PM PDT
Summary:
AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third party could send crafted IPv4 TCP packets to an affected listener, resulting in unauthenticated remote code execution. We will update this bulletin as more information becomes available.
Current Mitigation Status:
Amazon Linux
Amazon Linux 2 and Amazon Linux 2023 kernel packages for the resolution of CVE-2026-98432 are available. Customers should update their kernel packages and reboot. Kernel versions kernel-4.14, kernel-5.10, kernel-5.15, kernel-5.4, kernel-6.1, kernel-6.12, & kernel-6.18: Available now.
To update:
|
# Amazon Linux 2 # Amazon Linux 2023 |
Amazon EC2
Customers running self-managed Linux instances on Amazon EC2 are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.
After updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.
AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway
Customers using the above services do not receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self-managed instances behind these services within the next 30 days.
Network Load Balancer (TCP Listeners) and Amazon Global Accelerator
Customers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
Amazon EKS
Amazon EKS has released updated EKS-optimized Amazon Linux 2023 AMIs (release v20261031) that address this issue. Customers using managed node groups, self-managed nodes, or Karpenter with these AMIs should update their nodes to v20261031 or later. We expect to complete the global release of the updated Auto Mode AMIs by 2026-11-01. No customer action is required for Auto Mode. Amazon EKS Auto Mode will automatically replace existing nodes with an updated AMI that includes the patched kernel, subject to NodePool disruption budgets.
Amazon ECS
Customers running ECS on EC2 should update the kernel on their container instances and reboot, or replace them with instances launched from the latest ECS-optimized AMI (release 20261031).
- Fargate: AWS is releasing a patched platform version. All new tasks launched after November 01, 2026, 6:00 AM PDT (November 1, 2026, 01:00 PM UTC) will use the patched platform version. Existing tasks are retired per your task retirement settings, or you can replace them sooner as described in Task retirement and maintenance for AWS Fargate.
- ECS Managed Instances: AWS is releasing an updated AMI, and new instances launched after the same time will use the patched AMI. Existing instances are drained 14 days after launch, or earlier to align with your event windows (Patching in Amazon ECS Managed Instances). To update immediately, drain them manually.
Bottlerocket
Updated Bottlerocket AMIs with the patched kernel are expected to be available beginning November 02, 2026. We recommend customers update to the latest Bottlerocket AMI when available.
AWS Lambda
Lambda workloads are not affected by this vulnerability. CVE-2026-98432 requires an attacker to send a specially crafted network packet to a publicly reachable IPv4 TCP port on a vulnerable host. Lambda functions do not expose public IPv4 TCP ports, so there is no path for an external party to reach your function's execution environment with the type of traffic needed to trigger this vulnerability. No action is required on your part.
As a defense-in-depth measure, we are proactively applying the kernel patch to the Lambda service infrastructure.
Amazon Lightsail
Customers running self-managed Linux instances on Amazon Lightsail are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.
After updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.
VPC Endpoints (PrivateLink)
Customers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
VPC Lattice
Customers running Layer 4 targets (SRE, SNE) environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
RDS / Aurora
RDS / Aurora customers need to make sure that the database ports are not exposed from the internet. Additionally, we have taken mitigation efforts that is deploying worldwide to prevent exploit on your database host. Long term remediation will be for you to patch your database OS, this patch will be available Tuesday, November 3, 2026.
Neptune
Neptune customers need to make sure that the database ports are not exposed from the internet.
Redshift
Redshift is taking mitigation actions that are deploying worldwide to prevent exploit on your cluster hosts. For long term remediation, Redshift Cluster OS patch will be available Monday, November 2, 2026.
Storage Gateway
We are expecting an update beginning November 03, 2026. We recommend customers update to the latest version when available.
AWS Cloud9
AWS Cloud9 EC2 environments install Amazon Linux and Ubuntu security updates automatically, but an updated kernel takes effect only after the environment restarts. After the update installs, customers should restart each environment's EC2 instance, or stop the environment and start it again. Canonical has not yet released a fixed kernel for Ubuntu. Customers using Ubuntu environments should restart them after the fixed kernel installs. Customers using AWS Cloud9 SSH environments are responsible for updating the kernel on their own servers.
Amazon GameLift
Amazon GameLift Servers is releasing updated Amazon Linux 2 and Amazon Linux 2023 AMIs that include the patched kernel. Existing managed EC2 and container fleets continue to use the AMI they were created with. To receive the fix, create a new fleet after the updated AMIs are available and move your game session traffic to it, for example by updating your game session queue destinations or aliases. Recreating the fleet is the only way to make sure every instance has the fix, because fleets launch new instances from the AMI they were created with. We'll update this bulletin when the updated AMIs are available in all Regions. Fleets running Windows are not affected.
Customers using Anywhere fleets manage their own operating system and should update the kernel and reboot, as described for Amazon EC2 above.
Interim step for customers who cannot update immediately
Disable MPTCP by setting the kernel parameter net.mptcp.enabled=0, or set GODEBUG=multipathtcp=0 for applications built with Go 1.24 or later. This step reduces the conditions for running code on a host, but it does not resolve the issue. Updating the kernel and rebooting, or applying a livepatch, resolves the issue.
Customers can disable IP Options to mitigate this with an IP tables rule. An example is provided below:
| iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP |
AWS Network Firewall
AWS Network Firewall customers can mitigate by adding the following stateful rule, which drops IPv4 packets that carry IP options. Use a SID that isn't already used in their rule groups:
| drop ip any any -> any any (msg:"CVE-2026-98432: drop IPv4 packets carrying IP options (IHL > 5)"; ipv4.hdr; bsize:>20; classtype:bad-unknown; sid:1000001; rev:2;) |
Your firewall policy must use strict rule order. Give this rule group a lower priority number than your allow rule groups. Traffic that your stateless rules pass skips this rule.
If your policy uses default order, create a new strict-order policy and recreate your stateful rule groups in strict order. Then switch your firewall to the new policy. This changes how all your rules are evaluated and can interrupt existing connections, so test it first and monitor after the change.
References:
Please email aws-security@amazon.com with any security questions or concerns.