AWS issues Linux kernel fixes and service guidance for CVE-2026-98432
AWS says patched kernels are available for CVE-2026-98432, a Linux IPv4 TCP use-after-free issue affecting kernel 4.4 and later that can lead to crashes, kernel-memory disclosure, or memory corruption under specific conditions. Amazon Linux 2 and Amazon Linux 2023 customers need to update the kernel and reboot for the fix to take effect.
Anthropic, as cited by BleepingComputer and the Cloud Security Alliance, reported a two-stage unauthenticated remote-root exploit against a server with an MPTCP listener. AWS says self-managed EC2 and Lightsail Linux instances require customer remediation; ECS on EC2 customers should update container-instance kernels or replace them with the latest ECS-optimized AMI.
For EKS, AWS says patched AL2023 EKS-optimized AMIs are available and managed or self-managed nodes should move to release v20261031 or later; EKS Auto Mode replaces nodes with updated AMIs subject to disruption budgets. AWS also recommends interim risk reduction such as disabling MPTCP, setting GODEBUG=multipathtcp=0, or applying its IP-options filtering rule, but says those steps do not replace patching and rebooting.