Linux kernel TCP use-after-free CVE-2026-98432: AWS publishes kernel fixes and guidance

Linux kernel IPv4 TCP use-after-free (CVE-2026-98432)

• What: A memory-safety bug in the Linux kernel IPv4 TCP handshake path, affecting kernel 4.4 and later. A remote, unauthenticated attacker can send crafted IPv4 TCP packets carrying IP options to a listener, which can crash the kernel, leak kernel memory or corrupt memory. Researchers have shown remote code execution against hosts with a Multipath TCP (MPTCP) listener. See NVD CVE-2026-98432 and AWS bulletin 2026-160-AWS.
• Severity: Critical (CVSS 9.8 per the NVD ADP score); AWS rates its bulletin Important.
• Exploited: AWS says it is not aware of exploitation in the wild. Not on the CISA KEV catalog as of catalog 2026.10.30.
• Fixed in: Amazon Linux 2 and Amazon Linux 2023 kernel packages (ALAS2-2026-4065, ALAS2KERNEL-5.4-2026-135, ALAS2KERNEL-5.10-2026-137, ALAS2KERNEL-5.15-2026-120, ALAS2023-2026-3365, ALAS2023-2026-3335, ALAS2023-2026-3251). Amazon Linux 2023 hosts locked to a release need 2023.12.20261102 or later. EKS-optimized AL2023 AMIs v20261031 and ECS-optimized AMIs 20261031 include the fix, and new Fargate tasks launched after Nov 1, 2026 17:00 UTC use a patched platform. Debian has also shipped fixed kernels for its supported releases.
• What to do: Update the kernel and reboot every self-managed Linux host (sudo dnf update kernel --releasever=latest on Amazon Linux 2023, sudo yum update kernel on Amazon Linux 2). Prioritize hosts directly reachable from the internet and targets behind Network Load Balancer TCP listeners or Global Accelerator, which pass IP options through. AWS says instances behind ALB, CloudFront, API Gateway or WAF should still be updated within 30 days. Until you can reboot, disabling MPTCP reduces the demonstrated code-execution path.