{"id":"CVE-2026-98432","kind":"vulnerability","aliases":["CVE-2026-98432"],"related":[],"title":"In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU…","description":"CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue\n\n### CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue\n\nBulletin ID: 2026-160-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 22:15 PM PDT\n\n### Summary:\n\nAWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third party could send crafted IPv4 TCP packets to an affected listener, resulting in unauthenticated remote code execution. We will update this bulletin as more information becomes available.\n\nAmazon Linux\n\nAmazon Linux 2 and Amazon Linux 2023 kernel packages for the resolution of CVE-2026-98432 are available. Customers should update their kernel packages and reboot. Kernel versions kernel-4.14, kernel-5.10, kernel-5.15, kernel-5.4, kernel-6.1, kernel-6.12, & kernel-6.18: Updated in ALAS2023-2026-3251 (version 6.18.56-125.164). Available now. All kernels above: Updated in ALAS2023-2026-3335. Available now.\n\nTo update:\n\n# Amazon Linux 2 sudo yum update kernel && sudo reboot\n\n# Amazon Linux 2023 sudo dnf update kernel --releasever=latest && sudo reboot\n\nAmazon EC2\n\nCustomers running self-managed Linux instances on Amazon EC2 are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.\n\nAfter updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.\n\nAWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway\n\nThe customers using above services don't receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self managed instances behind these services with in the next 30 days.\n\nNetwork Load Balancer (TCP Listeners) and Amazon Global Accelerator\n\nCustomers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.\n\nAmazon EKS\n\nAmazon EKS has released updated EKS-optimized Amazon Linux 2023 AMIs for Kubernetes version 1.33 and later (release v20261026) that address this issue. Customers using managed node groups, self-managed nodes, or Karpenter with these AMIs should update their nodes to v20261026 or later. We expect to complete the global release of the updated Auto Mode AMI by November 06, 2026. No customer action is required for Auto Mode. Amazon EKS Auto Mode will automatically replace existing nodes with an updated AMI that includes the patched kernel, subject to NodePool disruption budgets.\n\nAmazon ECS\n\nCustomers running Amazon ECS on EC2 instances should update the kernel on their container instances as described above and reboot. For customers using AWS Fargate & ECS Managed Instance, AWS is applying updates to the underlying infrastructure. No customer action is required for Fargate & ECS Managed Instance tasks.\n\nBottlerocket\n\nUpdated Bottlerocket AMIs with the patched kernel are expected to be available beginning November 02, 2026. We recommend customers update to the latest Bottlerocket AMI when available.\n\nAWS Lambda\n\nLambda workloads are not affected by this issue CVE-2026-98432 requires an actor to send a specially crafted network packet to a publicly reachable IPv4 TCP port on an affected host. Lambda functions do not expose public IPv4 TCP ports, so there is no path for an external party to reach your function's execution environment with the type of traffic needed to trigger this issue. No action is required on your part.\n\nAs a defense-in-depth measure, we are proactively applying the kernel patch to the Lambda service infrastructure.\n\nAmazon Lightsail\n\nCustomers running self-managed Linux instances on Amazon Lightsail are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.\n\nAfter updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.\n\nVPC Endpoints (PrivateLink)\n\nCustomers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.\n\nVPC Lattice\n\nCustomers running Layer 4 targets (SRE, SNE) environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.\n\nRDS / Aurora\n\nRDS / Aurora customers need to make sure that the database ports are not exposed from the internet.\n\nNeptune\n\nNeptune customers need to make sure that the database ports are not exposed from the internet.\n\n### Interim step for customers who cannot update immediatel\n\nDisable MPTCP by setting the kernel parameter net.mptcp.enabled=0, or set GODEBUG=multipathtcp=0 for applications built with Go 1.24 or later. This step reduces the conditions for running code on a host, but it does not resolve the issue. Updating the kernel and rebooting, or applying a livepatch, resolves the issue\n\nCustomers can disable IP Options to mitigate this with an IP tables rule. An example is provided below:\n\n| iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP |\n| --- |\n\n### References:\n\n- CVE-2026-98432\n- ALAS2023-2026-3251\n- ALAS2023-2026-3335\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"A memory-handling bug (use-after-free) in the Linux kernel's IPv4 TCP handshake path affects kernel versions 4.4 and later. Under specific conditions, an unauthenticated remote attacker can send crafted IPv4 TCP packets to an affected listener and run code.","severity":"critical","cvss":9.8,"epss":0.00445,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amazon-linux","aws","bottlerocket","ecs","eks","go","infrastructure","lab-disclosure","linux","mptcp","self-managed-linux"],"not_affected_if":["fargate","lambda","managed-hosting","non-linux-platforms"],"how_to_check":"- Check the running kernel with `uname -r` on each Linux host, and compare it against the patched versions named in the AWS bulletin.\n- On Amazon Linux, list pending kernel updates for ALAS2023-2026-3251 and ALAS2023-2026-3335 and check whether the host has them installed.\n- Check whether MPTCP is enabled with `sysctl net.mptcp.enabled`, since the bulletin lists it as a factor that reduces conditions for exploitation.\n- For Go programs built with Go 1.24 or later, check whether `GODEBUG=multipathtcp=0` is set.","fix":"- Amazon Linux 2023 kernel 6.18 line: `6.18.56-125.164` (ALAS2023-2026-3251), plus ALAS2023-2026-3335 for all kernels.\n- Amazon EKS-optimized Amazon Linux 2023 AMIs: `v20261026` or later, for Kubernetes 1.33 and later.\n- Bottlerocket: updated AMIs with the patched kernel expected from November 02, 2026.\n- Kernel update followed by a reboot, or a livepatch, is the complete remediation. Disabling MPTCP reduces conditions but does not resolve the issue.","status":"open","published_at":"2026-10-15T13:17:13+00:00","first_seen_at":"2026-10-31T05:39:59+00:00","triaged_at":"2026-10-31T05:40:36+00:00","updated_at":"2026-10-31T06:03:50+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-31T05:40:36Z","model":"claude-haiku-5-5","output":{"fix":"- Amazon Linux 2023 kernel 6.18 line: `6.18.56-125.164` (ALAS2023-2026-3251), plus ALAS2023-2026-3335 for all kernels.\n- Amazon EKS-optimized Amazon Linux 2023 AMIs: `v20261026` or later, for Kubernetes 1.33 and later.\n- Bottlerocket: updated AMIs with the patched kernel expected from November 02, 2026.\n- Kernel update followed by a reboot, or a livepatch, is the complete remediation. Disabling MPTCP reduces conditions but does not resolve the issue.","reach":"internet","title":"Linux kernel: IPv4 TCP handshake memory bug allows remote code execution","impact":"high","summary":"A memory-handling bug (use-after-free) in the Linux kernel's IPv4 TCP handshake path affects kernel versions 4.4 and later. Under specific conditions, an unauthenticated remote attacker can send crafted IPv4 TCP packets to an affected listener and run code.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","aws","amazon-linux","eks","ecs","bottlerocket","self-managed-linux","mptcp","go"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker runs code on exposed Linux servers without login","analyst_note":"Sources conflict on severity: AWS gives no score, while linked discussion posts cite CVSS 9.8; verify the score and affected kernel ranges against NVD and the Linux kernel stable advisories.","how_to_check":"- Check the running kernel with `uname -r` on each Linux host, and compare it against the patched versions named in the AWS bulletin.\n- On Amazon Linux, list pending kernel updates for ALAS2023-2026-3251 and ALAS2023-2026-3335 and check whether the host has them installed.\n- Check whether MPTCP is enabled with `sysctl net.mptcp.enabled`, since the bulletin lists it as a factor that reduces conditions for exploitation.\n- For Go programs built with Go 1.24 or later, check whether `GODEBUG=multipathtcp=0` is set.","plain_action":"","needs_analyst":true,"not_affected_if":["lambda","fargate","managed-hosting","non-linux-platforms"],"who_is_affected":"Any Linux host that accepts inbound IPv4 TCP connections is in scope, including self-managed EC2 and Lightsail instances, EKS and ECS on EC2 nodes, and Linux-based endpoints behind TCP listeners. AWS states that WAF, ALB, CLB, TLS listeners on NLB, CloudFront, API Gateway, and Lambda are not directly exposed to untrusted TCP and need no immediate customer action. RDS and Neptune customers should confirm their database ports are not exposed to the internet.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001672,"input_tokens":6581,"output_tokens":2027,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-125.164':242C '-160':116C '-2026':22A,25A,90C,102C,138C,207C,238C,251C,650C '-3251':239C '-3335':252C '-4.14':222C '-5.10':224C '-5.15':226C '-5.4':228C '-6.1':230C '-6.12':232C '-6.18':234C '-98432':23A,26A,91C,103C,139C,208C,651C '02':626C '06':529C '1.33':483C '10/30/2026':127C '15':129C '2':195C,259C '2023':199C,268C,478C '2026':115C,530C,627C '22':128C '30':434C '4.4':66B,154C '6.18.56':241C 'acceler':444C 'action':409C,533C,602C,709C 'actor':654C 'address':489C 'affect':63B,84B,151C,173C,645C,671C 'alas2023':237C,250C 'amazon':28B,191C,193C,197C,257C,266C,277C,287C,301C,442C,466C,468C,476C,539C,562C,566C 'amazon-linux':27B 'ami':479C,505C,526C,551C,614C,636C 'anoth':313C 'api':374C 'appli':322C,396C,594C 'applic':358C,360C 'attack':75B 'attent':124C 'auto':524C,537C,541C 'automat':544C 'avail':190C,210C,243C,253C,328C,465C,623C,638C 'aw':30B,117C,119C,133C,356C,394C,587C,592C,639C 'awar':135C 'balanc':362C,365C,371C,438C 'becom':189C,327C 'begin':624C 'behind':427C 'best':392C 'bottlerocket':31B,611C,613C,635C 'budget':561C 'bug':49B 'bulletin':113C,185C 'classic':363C 'cloud':372C 'code':88B,179C 'complet':351C,517C 'condit':71B,159C 'connect':385C 'contain':577C 'content':120C 'could':165C 'craft':78B,167C,659C 'custom':211C,279C,377C,408C,421C,445C,492C,532C,564C,585C,601C,630C 'cve':21A,24A,89C,101C,137C,206C,649C 'date':126C 'day':435C 'describ':308C,580C 'direct':389C 'disclosur':38B 'disrupt':560C 'distribut':315C,318C 'dnf':270C 'ec':32B,563C,567C,589C,607C 'ec2':278C,288C,569C 'effect':342C 'ek':33B,467C,469C,474C,540C 'eks-optim':473C 'environ':447C,697C 'execut':180C,696C 'exist':546C 'expect':515C,620C 'expos':677C 'extern':689C 'fargat':588C,606C 'firewal':359C 'fix':324C,339C 'follow':6A,316C,391C 'free':12A,53B,99C,111C 'front':373C 'function':674C,694C 'gateway':375C 'global':443C,519C 'go':34B 'group':496C 'guidanc':320C 'handl':48B 'handshak':61B,149C 'host':672C 'id':114C 'immedi':407C 'import':122C 'includ':553C 'inet':13A 'inform':188C 'infrastructur':35B,401C,599C 'instanc':285C,297C,426C,570C,578C,591C,609C 'ipv4':11A,59B,79B,94C,106C,147C,168C,666C,679C 'ireq':16A 'issu':100C,112C,142C,355C,491C,648C,707C 'karpent':502C 'kernel':4A,57B,64B,93C,105C,146C,152C,200C,215C,219C,221C,223C,225C,227C,229C,231C,233C,246C,263C,272C,294C,305C,332C,344C,463C,556C,574C,618C 'kubernet':481C 'lab':37B 'lab-disclosur':36B 'lambda':640C,641C,673C 'later':68B,156C,485C,513C 'latest':274C,634C 'linux':3A,29B,39B,44B,56B,92C,104C,145C,192C,194C,198C,258C,267C,284C,302C,314C,449C,477C 'listen':85B,174C,367C,440C 'load':361C,364C,370C,437C 'manag':43B,283C,425C,494C,499C,590C,608C 'memori':47B,141C 'memory-handl':46B 'mode':525C,538C,542C 'mptcp':40B 'need':703C 'network':369C,436C,660C 'next':433C 'node':495C,500C,509C,547C 'nodepool':559C 'novemb':528C,625C 'opt':14A,17A 'optim':475C 'packag':201C,216C,306C 'packet':81B,170C,661C 'parti':164C,690C 'patch':462C,555C,617C 'path':62B,150C,686C 'pdt':131C 'platform':450C,454C,458C 'pm':130C 'port':668C,681C 'practic':393C 'public':125C,664C,678C 'rcu':20A 'reach':692C 'reachabl':665C 'reboot':218C,265C,276C,334C,347C,583C 'receiv':383C 'recommend':420C,629C 'releas':471C,486C,520C 'releasev':273C 'remedi':352C 'remot':74B,161C,178C 'replac':545C 'requir':123C,336C,411C,535C,604C,652C,711C 'resolut':204C 'resolv':10A 'respons':290C 'result':175C 'run':87B,280C,300C,312C,446C,565C 'scope':118C 'self':42B,282C,424C,498C 'self-manag':281C,497C 'self-managed-linux':41B 'send':77B,166C,656C 'servic':380C,404C,417C,429C 'sourc':388C 'special':658C 'specif':70B,158C 'still':419C 'subject':557C 'sudo':260C,264C,269C,275C 'summari':132C 'take':341C 'task':610C 'tcp':60B,80B,95C,107C,148C,169C,384C,439C,667C,680C 'third':163C 'tls':366C 'traffic':702C 'trigger':705C 'type':121C,700C 'unauthent':73B,162C,177C 'under':400C,598C 'untrust':387C 'updat':183C,213C,235C,248C,256C,262C,271C,292C,303C,330C,345C,397C,422C,452C,457C,472C,507C,523C,550C,572C,595C,612C,631C 'use':51B,97C,109C,378C,415C,493C,586C 'use-after-fre':50B,96C,108C 'v20261026':487C,511C 'version':65B,153C,220C,240C,455C,459C,482C 'vulner':7A 'web':357C 'workload':642C 'yum':261C","nicknames":[],"mitigations":[],"who_affected":"Any Linux host that accepts inbound IPv4 TCP connections is in scope, including self-managed EC2 and Lightsail instances, EKS and ECS on EC2 nodes, and Linux-based endpoints behind TCP listeners. AWS states that WAF, ALB, CLB, TLS listeners on NLB, CloudFront, API Gateway, and Lambda are not directly exposed to untrusted TCP and need no immediate customer action. RDS and Neptune customers should confirm their database ports are not exposed to the internet.","tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-15T13:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-160-aws/#CVE-2026-98432","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-160-aws/","severity":null,"published_at":"2026-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-31T05:39:59+00:00","fetched_at":"2026-10-31T05:39:59+00:00","note":"AWS: CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue"},{"source":"epss","external_id":"CVE-2026-98432","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98432","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-31T06:02:40+00:00","fetched_at":"2026-10-31T06:02:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-98432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98432","severity":null,"published_at":"2026-10-15T13:17:13+00:00","modified_at":"2026-10-30T16:18:00+00:00","first_seen_at":"2026-10-31T06:03:50+00:00","fetched_at":"2026-10-31T06:03:50+00:00","note":null}],"documents":[{"id":25975,"url":"https://www.bleepingcomputer.com/news/security/linux-kernel-exploit-enables-remote-root-attacks-on-mptcp-servers/","title":"BleepingComputer: Linux kernel exploit enables remote root attacks on MPTCP servers","kind":"blog","source":"analyst","publisher":null,"text":"BleepingComputer, Oct 30 2026, on CVE-2026-98432. Anthropic exploit: remote root on servers with MPTCP listener, bypasses KASLR, took about 53 minutes. Affects kernels back to 4.4. Ubuntu 22.04, 24.04, 26.04, 26.10 still vulnerable (fixes in progress as of Oct 30). RHEL 8, 9, 10 affected, fixes planned; RHEL 7 not affected. Rocky Linux 8, 9, 10 affected; CIQ shared temporary nftables rules blocking IPv4 TCP packets carrying IP options, and cautions that disabling MPTCP alone is insufficient since the bug is reachable via ordinary TCP. Debian fixed in 6.1.190-1 (Bookworm) and 6.12.113-1 (Trixie), plus testing/unstable. Oracle Linux, Amazon Linux, SUSE have released fixes for some kernels. No confirmed in-the-wild exploitation.","published_at":"2026-10-30T00:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":25977,"url":"https://t.co/i2BnWeuNDU","title":"BleepingComputer: Linux kernel exploit enables remote root attacks on MPTCP servers","kind":"blog","source":"analyst","publisher":null,"text":"BleepingComputer, Oct 30 2026, on CVE-2026-98432. Anthropic exploit: remote root on servers with MPTCP listener, bypasses KASLR, took about 53 minutes. Affects kernels back to 4.4. Ubuntu 22.04, 24.04, 26.04, 26.10 still vulnerable (fixes in progress as of Oct 30). RHEL 8, 9, 10 affected, fixes planned; RHEL 7 not affected. Rocky Linux 8, 9, 10 affected; CIQ shared temporary nftables rules blocking IPv4 TCP packets carrying IP options, and cautions that disabling MPTCP alone is insufficient since the bug is reachable via ordinary TCP. Debian fixed in 6.1.190-1 (Bookworm) and 6.12.113-1 (Trixie), plus testing/unstable. Oracle Linux, Amazon Linux, SUSE have released fixes for some kernels. No confirmed in-the-wild exploitation.","published_at":"2026-10-30T00:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":16269,"url":"https://news.ycombinator.com/item?id=50287647","title":"CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions","kind":"post","source":"hackernews","publisher":null,"text":"CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions\nhttps://ubuntu.com/security/CVE-2026-98432\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-29T12:03:44+00:00","relation":"discussion","confidence":null,"note":null},{"id":16909,"url":"https://x.com/cyb3rops/status/2115806593635811634","title":"@cyb3rops: CVE-2026-98432 is a good example of something that really concerns me about the ","kind":"post","source":"x","publisher":null,"text":"CVE-2026-98432 is a good example of something that really concerns me about the future of cybersecurity.\n\nhttps://t.co/VkCFCz3nWZ\n\nThe vulnerability was introduced in October 2015, more than 11 years ago, by a performance optimization in the Linux TCP/IPv4 networking stack. One https://t.co/LmytHdwhyL\n\nlikes 173 reposts 39","published_at":"2026-10-29T14:02:56+00:00","relation":"discussion","confidence":null,"note":"@cyb3rops"},{"id":19388,"url":"https://news.ycombinator.com/item?id=50295879","title":"Zero-click remote code execution in Linux","kind":"post","source":"hackernews","publisher":null,"text":"Zero-click remote code execution in Linux\nhttps://www.cve.org/CVERecord?id=CVE-2026-98432\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-29T21:00:36+00:00","relation":"discussion","confidence":null,"note":null},{"id":20051,"url":"https://news.ycombinator.com/item?id=50297892","title":"Critical TCP use-after-free: CVE-2026-98432","kind":"post","source":"hackernews","publisher":null,"text":"Critical TCP use-after-free: CVE-2026-98432\nhttps://www.rescana.com/post/linux-kernel-tcp-cve-2026-98432-use-after-free-prepare-now\n\n1 points, 1 comments on Hacker News","published_at":"2026-10-29T23:48:32+00:00","relation":"discussion","confidence":null,"note":null},{"id":20289,"url":"https://news.ycombinator.com/item?id=50298526","title":"Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432","kind":"post","source":"hackernews","publisher":null,"text":"Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432\nhttps://groups.google.com/g/golang-announce/c/PCoQcdxoScw\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-30T00:52:33+00:00","relation":"discussion","confidence":null,"note":null},{"id":20410,"url":"https://groups.google.com/g/golang-announce/c/PCoQcdxoScw","title":"Go Security Team: Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432","kind":"advisory","source":"analyst","publisher":null,"text":"Go security team notice. Linux kernel CVE-2026-98432 is a use-after-free in IPv4 TCP connection handling. Anthropic's exploit gets remote code execution against a server with Multipath TCP (MPTCP) listeners. The bug is not specific to MPTCP, so systems without MPTCP listeners may also be vulnerable to similar attacks. Since Go 1.24, Go programs enable MPTCP by default for listening sockets on Linux. Best fix: upgrade to a patched kernel. Mitigations: GODEBUG=multipathtcp=0 at runtime; 'godebug multipathtcp=0' in go.mod at build time; SetMultipathTCP on net.Dialer / net.ListenConfig per socket. The Go team calls disabling MPTCP a fragile mitigation (one exposed MPTCP listener still leaves the system vulnerable) and says it is premature to change Go's default; discussion at go.dev/issue/82717. No in-the-wild exploitation mentioned.","published_at":"2026-10-30T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":20411,"url":"https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html","title":"Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions","kind":"blog","source":"analyst","publisher":null,"text":"CVE-2026-98432: race-condition use-after-free in the Linux kernel code that sets up new IPv4 TCP connections; kernel CNA CVSS 9.8, Red Hat/Amazon/Oracle/SUSE score 5.9-8.1. Anthropic said on October 27 its AI model wrote an exploit letting a remote unauthenticated attacker run commands as root on Linux servers with a multipath TCP listener. Fix credits Anthropic researcher Xinyang Ge; patched upstream and backported to maintained stable branches (CVE published Oct 15). As of October 29, Ubuntu and RHEL had not released a fixed kernel. On Linux an application must request MPTCP when opening a socket. Related analysis (threatlandscape.io): introduced by commit 079096f103fa, kernels from roughly 4.4, upstream fix e3f33b0a1d89; no in-the-wild reports, not in CISA KEV.","published_at":"2026-10-29T15:57:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":20789,"url":"https://news.ycombinator.com/item?id=50299182","title":"CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation","kind":"post","source":"hackernews","publisher":null,"text":"CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation\nhttps://www.penligent.ai/hackinglabs/cve-2026-98432/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-30T02:33:04+00:00","relation":"discussion","confidence":null,"note":null},{"id":21039,"url":"https://x.com/sans_isc/status/2116009959230234650","title":"@sans_isc: SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analy","kind":"post","source":"x","publisher":null,"text":"SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign\n https://t.co/SaAmojEPUu https://t.co/WrC1pV5e1w\n\nlikes 4 reposts 2","published_at":"2026-10-30T03:31:02+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":28526,"url":"https://news.ycombinator.com/item?id=50312858","title":"Protecting against CVE-2026-98432","kind":"post","source":"hackernews","publisher":null,"text":"Protecting against CVE-2026-98432\nhttps://groups.google.com/g/golang-announce/c/PCoQcdxoScw?pli=1\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-31T03:07:32+00:00","relation":"discussion","confidence":null,"note":null},{"id":22366,"url":"https://x.com/TheHackersNews/status/2116090860412817588","title":"@TheHackersNews: 🚨 Go warns: Go 1.24+ apps on Linux accept multipath TCP connections by default.\n","kind":"post","source":"x","publisher":null,"text":"🚨 Go warns: Go 1.24+ apps on Linux accept multipath TCP connections by default.\n\nThat's what Anthropic's remote root exploit for Linux kernel flaw CVE-2026-98432 targeted.\n\nStopgap: GODEBUG=multipathtcp=0 (Go calls it \"fragile\")\n\nBest fix: patched kernel https://t.co/PYeMZeJMO1\n\nlikes 411 reposts 50","published_at":"2026-10-30T08:52:30+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":29457,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-160-aws/","title":"AWS: CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue\n\n### CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue\n\nBulletin ID: 2026-160-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 22:15 PM PDT\n\n### Summary:\n\nAWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third party could send crafted IPv4 TCP packets to an affected listener, resulting in unauthenticated remote code execution. We will update this bulletin as more information becomes available.\n\nAmazon Linux\n\nAmazon Linux 2 and Amazon Linux 2023 kernel packages for the resolution of CVE-2026-98432 are available. Customers should update their kernel packages and reboot. Kernel versions kernel-4.14, kernel-5.10, kernel-5.15, kernel-5.4, kernel-6.1, kernel-6.12, & kernel-6.18: Updated in ALAS2023-2026-3251 (version 6.18.56-125.164). Available now. All kernels above: Updated in ALAS2023-2026-3335. Available now.\n\nTo update:\n\n# Amazon Linux 2 sudo yum update kernel && sudo reboot\n\n# Amazon Linux 2023 sudo dnf update kernel --releasever=latest && sudo reboot\n\nAmazon EC2\n\nCustomers running self-managed Linux instances on Amazon EC2 are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.\n\nAfter updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.\n\nAWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway\n\nThe customers using above services don't receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self managed instances behind these services with in the next 30 days.\n\nNetwork Load Balancer (TCP Listeners) and Amazon Global Accelerator\n\nCustomers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.\n\nAmazon EKS\n\nAmazon EKS has released updated EKS-optimized Amazon Linux 2023 AMIs for Kubernetes version 1.33 and later (release v20261026) that address this issue. Customers using managed node groups, self-managed nodes, or Karpenter with these AMIs should update their nodes to v20261026 or later. We expect to complete the global release of the updated Auto Mode AMI by November 06, 2026. No customer action is required for Auto Mode. Amazon EKS Auto Mode will automatically replace existing nodes with an updated AMI that includes the patched kernel, subject to NodePool disruption budgets.\n\nAmazon ECS\n\nCustomers running Amazon ECS on EC2 instances should update the kernel on their container instances as described above and reboot. For customers using AWS Fargate & ECS Managed Instance, AWS is applying updates to the underlying infrastructure. No customer action is required for Fargate & ECS Managed Instance tasks.\n\nBottlerocket\n\nUpdated Bottlerocket AMIs with the patched kernel are expected to be available beginning November 02, 2026. We recommend customers update to the latest Bottlerocket AMI when available.\n\nAWS Lambda\n\nLambda workloads are not affected by this issue CVE-2026-98432 requires an actor to send a specially crafted network packet to a publicly reachable IPv4 TCP port on an affected host. Lambda functions do not expose public IPv4 TCP ports, so there is no path for an external party to reach your function's execution environment with the type of traffic needed to trigger this issue. No action is required on your part.\n\nAs a defense-in-depth measure, we are proactively applying the kernel patch to the Lambda service infrastructure.\n\nAmazon Lightsail\n\nCustomers running self-managed Linux instances on Amazon Lightsail are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available.\n\nAfter updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue.\n\nVPC Endpoints (PrivateLink)\n\nCustomers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.\n\nVPC Lattice\n\nCustomers running Layer 4 targets (SRE, SNE) environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available.\n\nRDS / Aurora\n\nRDS / Aurora customers need to make sure that the database ports are not exposed from the internet.\n\nNeptune\n\nNeptune customers need to make sure that the database ports are not exposed from the internet.\n\n### Interim step for customers who cannot update immediatel\n\nDisable MPTCP by setting the kernel parameter net.mptcp.enabled=0, or set GODEBUG=multipathtcp=0 for applications built with Go 1.24 or later. This step reduces the conditions for running code on a host, but it does not resolve the issue. Updating the kernel and rebooting, or applying a livepatch, resolves the issue\n\nCustomers can disable IP Options to mitigate this with an IP tables rule. An example is provided below:\n\n| iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP |\n| --- |\n\n### References:\n\n- CVE-2026-98432\n- ALAS2023-2026-3251\n- ALAS2023-2026-3335\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-31T05:21:05+00:00","relation":"mentions","confidence":null,"note":null},{"id":24505,"url":"https://news.ycombinator.com/item?id=50305855","title":"Go program are vulnerable to CVE-2026-98432 (Linux TCP Use-After-Free)","kind":"post","source":"hackernews","publisher":null,"text":"Go program are vulnerable to CVE-2026-98432 (Linux TCP Use-After-Free)\nhttps://groups.google.com/g/golang-announce/c/PCoQcdxoScw?pli=1\n\n2 points, 1 comments on Hacker News","published_at":"2026-10-30T16:02:54+00:00","relation":"discussion","confidence":null,"note":null},{"id":25202,"url":"https://news.ycombinator.com/item?id=50308386","title":"Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)","kind":"post","source":"hackernews","publisher":null,"text":"Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)\nhttps://www.openwall.com/lists/oss-security/2026/10/30/1\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-30T18:44:27+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}