Linux TCP flaw CVE-2026-98432: patch status and what to check

CVE-2026-98432 is a use-after-free flaw in the Linux kernel’s IPv4 TCP handshake path. Operators of Linux hosts and containers accepting inbound connections should check their kernels. AWS published its bulletin on 30 October 2026 at 22:15 PDT and last updated it on 2 November at 15:00 PST. Checked at 01:18 Taipei time on 4 November 2026, it still reports no evidence of exploitation in the wild.

Vendors describe the impact differently. Amazon Linux’s CVE page mentions denial of service or possible memory corruption, while Anthropic’s researchers achieved remote code execution against a host with a Multipath TCP (MPTCP) listener. MPTCP was part of that demonstration, but Ubuntu and the Go security team both say the bug itself does not depend on it.

Who needs to act

According to AWS’s service-by-service guidance, customers must update self-managed EC2 instances, Linux targets behind NLB TCP listeners and PrivateLink, and ECS on EC2; EKS nodes on the listed AL2023 AMIs need v20261031 or later. AWS patches the infrastructure behind ALB, CloudFront and NLB TLS listeners itself, but still recommends updating self-managed backends within 30 days. If an EC2 instance runs another distribution, that distribution’s advisory is the one that counts.

Patch availability

“Unlisted” means the cited bulletin lists none. Ubuntu entries cover the linux package; check cloud kernel flavours separately.

Distribution	Released	Testing (-proposed)	In progress	Not affected	Source / page updated
Amazon Linux	AL2: 4.14/5.4/5.10/5.15; AL2023: 6.1/6.12/6.18	Unlisted	Unlisted	Unlisted	AWS / 2 Nov 2026
Ubuntu	Unconfirmed	22.04/24.04/26.04	16.04/18.04/20.04; 26.10 conflicting	14.04	CVE / 3 Nov 2026; blog published 2 Nov
Red Hat	Unlisted	Unlisted	RHEL 8/9/10, OpenShift; no RHSA listed	Unlisted	RHSB / published 30 Oct 2026

Ubuntu’s blog calls 26.10 fixed in 7.3.0-10.10; its more recently updated CVE page still says work in progress. At this check the two pages still disagreed. Packages in -proposed are undergoing testing and are not selected for upgrades by default.

Check in this order

Inventory inbound IPv4 TCP services, including containers that have their own networking.
Find the advisory for your distribution and kernel package; for Amazon Linux, the CVE page links to each ALAS.
Install the fix. AL2023 systems locked to a release need 2023.12.20261102 or later.
Reboot. AWS calls a kernel update plus reboot the only complete remediation.
Compare uname -r with the fixed version in the advisory, as Ubuntu’s post suggests.

Do not judge by the upstream version alone: AL2’s fixed package is 5.10.271-272.1121.amzn2, while upstream’s 5.10 branch is fixed from 5.10.272; Amazon backported the fix. The ALAS page also lists livepatch RPMs, though the AWS bulletin never says they can stand in for the reboot.

Temporary mitigation

Disabling MPTCP with net.mptcp.enabled=0 narrows the conditions AWS describes, and leaves the flaw in place. Go programs from 1.24 onwards open MPTCP listeners on Linux by default; GODEBUG=multipathtcp=0 turns that off, according to the Go security team.

Ubuntu and Red Hat both publish an nftables rule that drops inbound TCP packets carrying IPv4 options. These are options in the IP header; TCP options such as timestamps pass untouched. Ubuntu notes that the rule covers the host itself; containers with separate networking need their own copy. Anything that relies on IPv4 options will break, so check that before you filter. Both vendors say the rule reduces risk without preventing exploitation; remove it once the kernel is patched.

Notes

MPTCP was a condition of the demonstrated RCE. The flaw itself does not require it.
Ubuntu’s fixes for 22.04, 24.04 and 26.04 sit in -proposed and have to be selected explicitly.
Vendors backport fixes, so read the full distribution package version, not the upstream number.
After updating, reboot and confirm the running kernel with uname -r.