Live › vulnerability › CVE-2026-98432
A memory-handling bug (use-after-free) in the Linux kernel's IPv4 TCP handshake path affects kernel versions 4.4 and later. Under specific conditions, an unauthenticated remote attacker can send crafted IPv4 TCP packets to an affected listener and run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 05:39 UTC, 0h before NVD. All times on this page are UTC.
Any Linux host that accepts inbound IPv4 TCP connections is in scope, including self-managed EC2 and Lightsail instances, EKS and ECS on EC2 nodes, and Linux-based endpoints behind TCP listeners. AWS states that WAF, ALB, CLB, TLS listeners on NLB, CloudFront, API Gateway, and Lambda are not directly exposed to untrusted TCP and need no immediate customer action. RDS and Neptune customers should confirm their database ports are not exposed to the internet.
No product ranges from the sources yet.
uname -r on each Linux host, and compare it against the patched versions named in the AWS bulletin.sysctl net.mptcp.enabled, since the bulletin lists it as a factor that reduces conditions for exploitation.GODEBUG=multipathtcp=0 is set.6.18.56-125.164 (ALAS2023-2026-3251), plus ALAS2023-2026-3335 for all kernels.v20261026 or later, for Kubernetes 1.33 and later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@sans_isc · X4 likes · 2 reposts2026-10-30 03:31“SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign https://t.co/SaAmojEPUu https://t.co/WrC1pV5e1w”
View on X
@TheHackersNews · X411 likes · 50 reposts2026-10-30 08:52“🚨 Go warns: Go 1.24+ apps on Linux accept multipath TCP connections by default. That's what Anthropic's remote root exploit for Linux kernel flaw CVE-2026-98432 targeted. Stopgap: GODEBUG=multipathtcp=0 (Go calls it "fragile") Best fix: patched kernel https://t.co/PYeMZeJMO1”
View on X
@cyb3rops · X173 likes · 39 reposts2026-10-29 14:02“CVE-2026-98432 is a good example of something that really concerns me about the future of cybersecurity. https://t.co/VkCFCz3nWZ The vulnerability was introduced in October 2015, more than 11 years ago, by a performance optimization in the Linux TCP/IPv4 networking stack. One https://t.co/LmytHdwhyL”
View on X
Hacker News · Hacker News2 points2026-10-30 16:02“Go program are vulnerable to CVE-2026-98432 (Linux TCP Use-After-Free) https://groups.google.com/g/golang-announce/c/PCoQcdxoScw?pli=1”
View on Hacker News
Hacker News · Hacker News1 points2026-10-29 12:03“CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions https://ubuntu.com/security/CVE-2026-98432”
View on Hacker News
Hacker News · Hacker News1 points2026-10-29 21:00“Zero-click remote code execution in Linux https://www.cve.org/CVERecord?id=CVE-2026-98432”
View on Hacker News
Hacker News · Hacker News1 points2026-10-29 23:48“Critical TCP use-after-free: CVE-2026-98432 https://www.rescana.com/post/linux-kernel-tcp-cve-2026-98432-use-after-free-prepare-now”
View on Hacker News
Hacker News · Hacker News1 points2026-10-30 00:52“Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432 https://groups.google.com/g/golang-announce/c/PCoQcdxoScw”
View on Hacker News
Hacker News · Hacker News1 points2026-10-30 02:33“CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation https://www.penligent.ai/hackinglabs/cve-2026-98432/”
View on Hacker News
Hacker News · Hacker News1 points2026-10-31 03:07“Protecting against CVE-2026-98432 https://groups.google.com/g/golang-announce/c/PCoQcdxoScw?pli=1”
View on Hacker News
Hacker News · Hacker News1 points2026-10-30 18:44“Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432) https://www.openwall.com/lists/oss-security/2026/10/30/1”
View on Hacker News
Posts are quoted with a link to the original. They are data to us, never instructions.
CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue
Bulletin ID: 2026-160-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 22:15 PM PDT
AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third party could send crafted IPv4 TCP packets to an affected listener, resulting in unauthenticated remote code execution. We will update this bulletin as more information becomes available.
Amazon Linux
Amazon Linux 2 and Amazon Linux 2023 kernel packages for the resolution of CVE-2026-98432 are available. Customers should update their kernel packages and reboot. Kernel versions kernel-4.14, kernel-5.10, kernel-5.15, kernel-5.4, kernel-6.1, kernel-6.12, & kernel-6.18: Updated in ALAS2023-2026-3251 (version 6.18.56-125.164). Available now. All kernels above: Updated in ALAS2023-2026-3335. Available now.
To update:
Amazon EC2
Customers running self-managed Linux instances on Amazon EC2 are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.
After updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.
AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway
The customers using above services don't receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self managed instances behind these services with in the next 30 days.
Network Load Balancer (TCP Listeners) and Amazon Global Accelerator
Customers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
Amazon EKS
Amazon EKS has released updated EKS-optimized Amazon Linux 2023 AMIs for Kubernetes version 1.33 and later (release v20261026) that address this issue. Customers using managed node groups, self-managed nodes, or Karpenter with these AMIs should update their nodes to v20261026 or later. We expect to complete the global release of the updated Auto Mode AMI by November 06, 2026. No customer action is required for Auto Mode. Amazon EKS Auto Mode will automatically replace existing nodes with an updated AMI that includes the patched kernel, subject to NodePool disruption budgets.
Amazon ECS
Customers running Amazon ECS on EC2 instances should update the kernel on their container instances as described above and reboot. For customers using AWS Fargate & ECS Managed Instance, AWS is applying updates to the underlying infrastructure. No customer action is required for Fargate & ECS Managed Instance tasks.
Bottlerocket
Updated Bottlerocket AMIs with the patched kernel are expected to be available beginning November 02, 2026. We recommend customers update to the latest Bottlerocket AMI when available.
AWS Lambda
Lambda workloads are not affected by this issue CVE-2026-98432 requires an actor to send a specially crafted network packet to a publicly reachable IPv4 TCP port on an affected host. Lambda functions do not expose public IPv4 TCP ports, so there is no path for an external party to reach your function's execution environment with the type of traffic needed to trigger this issue. No action is required on your part.
As a defense-in-depth measure, we are proactively applying the kernel patch to the Lambda service infrastructure.
Amazon Lightsail
Customers running self-managed Linux instances on Amazon Lightsail are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.
After updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.
VPC Endpoints (PrivateLink)
Customers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
VPC Lattice
Customers running Layer 4 targets (SRE, SNE) environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.
RDS / Aurora
RDS / Aurora customers need to make sure that the database ports are not exposed from the internet.
Neptune
Neptune customers need to make sure that the database ports are not exposed from the internet.
Disable MPTCP by setting the kernel parameter net.mptcp.enabled=0, or set GODEBUG=multipathtcp=0 for applications built with Go 1.24 or later. This step reduces the conditions for running code on a host, but it does not resolve the issue. Updating the kernel and rebooting, or applying a livepatch, resolves the issue
Customers can disable IP Options to mitigate this with an IP tables rule. An example is provided below:
| iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP |
|---|
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-98432")
EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.