--- id: "CVE-2026-98432" kind: "vulnerability" aliases: ["CVE-2026-98432"] title: "In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU\u2026" severity: "critical" cvss: 9.8 epss: 0.00445 exploited: false status: "open" category: "infrastructure" products: [] ecosystems: [] tags: ["amazon-linux", "aws", "bottlerocket", "ecs", "eks", "go", "infrastructure", "lab-disclosure", "linux", "mptcp", "self-managed-linux"] not_affected_if: ["fargate", "lambda", "managed-hosting", "non-linux-platforms"] published_at: "2026-10-15T13:17:13+00:00" first_seen_at: "2026-10-31T05:39:59+00:00" updated_at: "2026-10-31T06:03:50+00:00" sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-160-aws/", "first_seen_at": "2026-10-31T05:39:59+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98432", "first_seen_at": "2026-10-31T06:02:40+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98432", "first_seen_at": "2026-10-31T06:03:50+00:00"}] --- # In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU… A memory-handling bug (use-after-free) in the Linux kernel's IPv4 TCP handshake path affects kernel versions 4.4 and later. Under specific conditions, an unauthenticated remote attacker can send crafted IPv4 TCP packets to an affected listener and run code. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check the running kernel with `uname -r` on each Linux host, and compare it against the patched versions named in the AWS bulletin. - On Amazon Linux, list pending kernel updates for ALAS2023-2026-3251 and ALAS2023-2026-3335 and check whether the host has them installed. - Check whether MPTCP is enabled with `sysctl net.mptcp.enabled`, since the bulletin lists it as a factor that reduces conditions for exploitation. - For Go programs built with Go 1.24 or later, check whether `GODEBUG=multipathtcp=0` is set. ## Fix - Amazon Linux 2023 kernel 6.18 line: `6.18.56-125.164` (ALAS2023-2026-3251), plus ALAS2023-2026-3335 for all kernels. - Amazon EKS-optimized Amazon Linux 2023 AMIs: `v20261026` or later, for Kubernetes 1.33 and later. - Bottlerocket: updated AMIs with the patched kernel expected from November 02, 2026. - Kernel update followed by a reboot, or a livepatch, is the complete remediation. Disabling MPTCP reduces conditions but does not resolve the issue. ## Timeline - 2026-10-31T05:39:59+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-160-aws/ — AWS: CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue - 2026-10-31T06:02:40+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98432 - 2026-10-31T06:03:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98432 ## Documents - [advisory] Go Security Team: Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432 https://groups.google.com/g/golang-announce/c/PCoQcdxoScw - [discussion] @cyb3rops: CVE-2026-98432 is a good example of something that really concerns me about the https://x.com/cyb3rops/status/2115806593635811634 - [discussion] Go program are vulnerable to CVE-2026-98432 (Linux TCP Use-After-Free) https://news.ycombinator.com/item?id=50305855 - [discussion] Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432) https://news.ycombinator.com/item?id=50308386 - [discussion] Zero-click remote code execution in Linux https://news.ycombinator.com/item?id=50295879 - [discussion] Critical TCP use-after-free: CVE-2026-98432 https://news.ycombinator.com/item?id=50297892 - [discussion] Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432 https://news.ycombinator.com/item?id=50298526 - [discussion] CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions https://news.ycombinator.com/item?id=50287647 - [discussion] CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation https://news.ycombinator.com/item?id=50299182 - [discussion] @sans_isc: SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analy https://x.com/sans_isc/status/2116009959230234650 - [discussion] @TheHackersNews: 🚨 Go warns: Go 1.24+ apps on Linux accept multipath TCP connections by default. https://x.com/TheHackersNews/status/2116090860412817588 - [discussion] Protecting against CVE-2026-98432 https://news.ycombinator.com/item?id=50312858 - [mentions] Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html - [mentions] BleepingComputer: Linux kernel exploit enables remote root attacks on MPTCP servers https://t.co/i2BnWeuNDU - [mentions] BleepingComputer: Linux kernel exploit enables remote root attacks on MPTCP servers https://www.bleepingcomputer.com/news/security/linux-kernel-exploit-enables-remote-root-attacks-on-mptcp-servers/ - [mentions] AWS: CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue https://aws.amazon.com/security/security-bulletins/rss/2026-160-aws/ ## From the sources CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue ### CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue Bulletin ID: 2026-160-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 22:15 PM PDT ### Summary: AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third party could send crafted IPv4 TCP packets to an affected listener, resulting in unauthenticated remote code execution. We will update this bulletin as more information becomes available. Amazon Linux Amazon Linux 2 and Amazon Linux 2023 kernel packages for the resolution of CVE-2026-98432 are available. Customers should update their kernel packages and reboot. Kernel versions kernel-4.14, kernel-5.10, kernel-5.15, kernel-5.4, kernel-6.1, kernel-6.12, & kernel-6.18: Updated in ALAS2023-2026-3251 (version 6.18.56-125.164). Available now. All kernels above: Updated in ALAS2023-2026-3335. Available now. To update: # Amazon Linux 2 sudo yum update kernel && sudo reboot # Amazon Linux 2023 sudo dnf update kernel --releasever=latest && sudo reboot Amazon EC2 Customers running self-managed Linux instances on Amazon EC2 are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available. After updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue. AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway The customers using above services don't receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self managed instances behind these services with in the next 30 days. Network Load Balancer (TCP Listeners) and Amazon Global Accelerator Customers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available. Amazon EKS Amazon EKS has released updated EKS-optimized Amazon Linux 2023 AMIs for Kubernetes version 1.33 and later (release v20261026) that address this issue. Customers using managed node groups, self-managed nodes, or Karpenter with these AMIs should update their nodes to v20261026 or later. We expect to complete the global release of the updated Auto Mode AMI by November 06, 2026. No customer action is required for Auto Mode. Amazon EKS Auto Mode will automatically replace existing nodes with an updated AMI that includes the patched kernel, subject to NodePool disruption budgets. Amazon ECS Customers running Amazon ECS on EC2 instances should update the kernel on their container instances as described above and reboot. For customers using AWS Fargate & ECS Managed Instance, AWS is applying updates to the underlying infrastructure. No customer action is required for Fargate & ECS Managed Instance tasks. Bottlerocket Updated Bottlerocket AMIs with the patched kernel are expected to be available beginning November 02, 2026. We recommend customers update to the latest Bottlerocket AMI when available. AWS Lambda Lambda workloads are not affected by this issue CVE-2026-98432 requires an actor to send a specially crafted network packet to a publicly reachable IPv4 TCP port on an affected host. Lambda functions do not expose public IPv4 TCP ports, so there is no path for an external party to reach your function's execution environment with the type of traffic needed to trigger this issue. No action is required on your part. As a defense-in-depth measure, we are proactively applying the kernel patch to the Lambda service infrastructure. Amazon Lightsail Customers running self-managed Linux instances on Amazon Lightsail are responsible for updating the kernel on those instances. If you run Amazon Linux, update the kernel package as described above. If you run another Linux distribution, follow your distribution's guidance for applying the fix when it becomes available. After updating the kernel, a reboot is required for the fix to take effect. A kernel update and reboot is the only complete remediation for this issue. VPC Endpoints (PrivateLink) Customers running environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available. VPC Lattice Customers running Layer 4 targets (SRE, SNE) environments on Linux platform should update their platform version once updated platform versions with the patched kernel are available. RDS / Aurora RDS / Aurora customers need to make sure that the database ports are not exposed from the internet. Neptune Neptune customers need to make sure that the database ports are not exposed from the internet. ### Interim step for customers who cannot update immediatel Disable MPTCP by setting the kernel parameter net.mptcp.enabled=0, or set GODEBUG=multipathtcp=0 for applications built with Go 1.24 or later. This step reduces the conditions for running code on a host, but it does not resolve the issue. Updating the kernel and rebooting, or applying a livepatch, resolves the issue Customers can disable IP Options to mitigate this with an IP tables rule. An example is provided below: | iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP | | --- | ### References: - CVE-2026-98432 - ALAS2023-2026-3251 - ALAS2023-2026-3335 Please email aws-security@amazon.com with any security questions or concerns. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_