CVE-2026-98432: Patch and Mitigation Guide for the Critical Linux Kernel TCP Flaw

CVE-2026-98432, a flaw in the code that handles IPv4 TCP connection setup in the Linux kernel, has been rated critical by Red Hat. It can be triggered over the network without authentication or user interaction and can lead to remote code execution. In this article we cover what the flaw is, which systems are affected, the patch status as of November 2, 2026, and the interim measures you can apply until a fix is available.

What is CVE-2026-98432?

The flaw is a use-after-free bug in the kernel’s IPv4 networking subsystem. While a TCP connection request is being processed, socket options are freed even though a concurrent operation, such as a retransmitted connection request or a socket migration, may still be accessing that memory. An attacker who exploits this race condition can execute code remotely.

According to Red Hat, exploitation requires precise timing of network requests but no privileges or user interaction. AWS also confirms that, under specific conditions, crafted IPv4 TCP packets can lead to unauthenticated remote code execution.

Which systems are affected?

• Kernel version: According to AWS, all Linux kernels from version 4.4 onward.
• Red Hat: RHEL 8, 9, 10 and OpenShift Container Platform are directly affected. Layered products that rely on the RHEL kernel, such as RHEL CoreOS, OpenStack Platform and Red Hat Virtualization, are also potentially affected.
• Highest risk: Servers that accept inbound TCP connections, especially those with ports exposed to the internet. Since TCP underpins almost every network service, the affected surface is broad.

Patch status (as of November 2, 2026)

• Amazon Linux 2 and 2023: Fixed kernel packages are available (kernels 4.14, 5.4, 5.10, 5.15, 6.1, 6.12 and 6.18).
• RHEL 8, 9, 10 and OpenShift: Red Hat says it is expediting fixes; no fix had been released when its bulletin was published on October 30.
• Ubuntu: According to the AWS bulletin updated on October 31, Canonical has not yet released a fixed kernel.

The situation can change within a day. Always check your distribution’s security page for the current status.

To update Amazon Linux:

# Amazon Linux 2
sudo yum update kernel && sudo reboot

# Amazon Linux 2023
sudo dnf update kernel --releasever=latest && sudo reboot

Running in the cloud is not protection on its own

In cloud environments, responsibility depends on the service. The AWS bulletin makes this distinction clear:

• EC2 and Lightsail: You are responsible for updating the kernel on servers you manage. If you run Ubuntu on AWS, the Amazon Linux update does not fix your server.
• ALB, CloudFront, API Gateway, WAF: AWS is updating the infrastructure behind these services, but you are advised to update your own instances behind them within 30 days.
• EKS and ECS: Updated AMIs (v20261031 and later) are available; you need to move your nodes and container instances to these versions.
• RDS and Aurora: Make sure database ports are not exposed to the internet. AWS has announced that the permanent patch will be available on November 3, 2026.
• Lambda: Not affected, as functions do not expose public IPv4 TCP ports.

In container environments, what matters is not the container image but the kernel of the host the container runs on. In layered products such as OpenShift, the underlying RHEL kernel must also be up to date.

Interim mitigations for CVE-2026-98432

On systems without a released patch, the measures below reduce the risk but do not close the flaw. The only complete fix is to install the patched kernel and reboot (or apply a livepatch). Test every rule against your own traffic before deploying it to production.

1. Drop IPv4 TCP packets carrying IP options (nftables)

The rule recommended by Red Hat drops incoming IPv4 TCP packets that contain IP options. Because standard TCP options are carried in the TCP header, ordinary application traffic is expected to remain unaffected. Save the following as cve-2026-98432.nft:

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

Validate and apply the rule:

sudo nft --check --file cve-2026-98432.nft
sudo nft --file cve-2026-98432.nft
sudo nft list table inet cve_2026_98432

Remove the rule once the kernel has been updated:

sudo nft delete table inet cve_2026_98432

2. If you use iptables

AWS provides an iptables rule for the same purpose:

sudo iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP

3. Disable MPTCP if you do not use it

As an interim step, AWS recommends disabling multipath TCP (MPTCP). This reduces the conditions for running code on a host, but it does not resolve the issue:

sysctl net.mptcp.enabled
echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/90-disable-mptcp.conf
sudo sysctl -w net.mptcp.enabled=0

For applications built with Go 1.24 or later, the GODEBUG=multipathtcp=0 environment variable has the same effect.

4. If you use AWS Network Firewall

You can add a stateful rule that drops IPv4 packets carrying IP options at the network level. For the rule to work, your firewall policy must use strict rule order:

drop ip any any -> any any (msg:"CVE-2026-98432: drop IPv4 packets carrying IP options (IHL > 5)"; ipv4.hdr; bsize:>20; classtype:bad-unknown; sid:1000001; rev:2;)

Step-by-step checklist

1. Build an inventory. Which distribution and kernel version runs on each server (uname -r), and which ones are exposed to the internet? Prioritize internet-facing servers.
2. Update and reboot where a patch exists. Unless you use livepatching, a kernel fix only takes effect after a reboot.
3. Apply an interim mitigation where no patch exists. Test the rule in a non-production environment first, then roll it out.
4. Review your cloud services one by one. Be clear about which layer is the provider’s responsibility and which is yours.
5. Act quickly when the patch lands. Remove the interim rules after updating the kernel.

Sources: Red Hat Security Bulletin RHSB-2026-016 and AWS Security Bulletin 2026-160-AWS.

If you need help building an inventory of your Linux servers, planning patches or safely deploying interim mitigations, get in touch with us.