A race in Linux IPv4/TCP connection handling can corrupt kernel memory, with possible remote code execution without authentication. Check the running kernel and distributor advisory, then activate the applicable correction; active exploitation is not established.
Who should check: Teams operating Linux hosts or container nodes that accept IPv4 TCP connections, including Amazon Linux 2/2023, RHEL 8/9/10, EKS, ECS and OpenShift operators.
Identify affected running kernels and reachable listeners. Apply the correction for the installed distribution and branch, reboot where required, and verify the active kernel or replacement nodes.
During TCP connection handling, one CPU can free socket options while another still reads them. The Linux CNA correction defers freeing until an RCU grace period has passed. Request-socket migration has a related lifetime problem; disabling migration alone does not establish that a host is protected.
The CNA records affected code from Linux 4.4 and branch fixes at 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. These are upstream boundaries. Distributor backports require package-specific evidence.
AWS reports Amazon Linux 2/2023 kernel corrections and requires an update and reboot. EKS and ECS operators must verify the instances running corrected images. EKS Auto Mode replacement is subject to disruption budgets; the rollout target is not confirmation that every node has changed. Bottlerocket availability remains a November 2 target in the reviewed bulletin.
Red Hat lists RHEL 8/9/10 and OpenShift and says it is expediting fixes. Its bulletin does not establish that every affected branch has a released correction. AWS versions cannot establish Red Hat remediation.
Amazon Linux rates this CVE 8.1; Red Hat lists a preliminary 9.8. The assessments differ on attack complexity, so this record does not collapse them into one score. Possible remote code execution is not evidence of attacks in the wild.
The Linux CNA published the record on October 15. This advisory is separate from CVE-2026-46300, which concerns local escalation and the PHP2Shell chain; that record's exploitation evidence does not apply here.
| Product | Affected | Fixed release / action |
|---|---|---|
| Linux upstream branches | Affected code introduced in 4.4; check the correction for each maintained branch. Distributor backports can use different version numbers. | 5.10.2725.15.2236.1.1906.6.1596.12.1136.18.567.2.107.3 |
| Amazon Linux 2 / Amazon Linux 2023 | Installed kernels without the applicable CVE-2026-98432 security update. | Apply the branch-specific kernel update and reboot. Verify the running kernel against the Amazon Linux advisory. |
| EKS / ECS on EC2 | Instances running affected host kernels; a corrected image configuration alone does not update existing nodes. | EKS-optimized AL2023 AMI v20261031ECS-optimized AMI 20261031Replace affected nodes or apply the supported kernel update and reboot. |
| RHEL 8 / 9 / 10 and OpenShift | Vulnerable underlying kernels identified by Red Hat, including layered products. | Corrections are being expedited. Check the applicable product and branch erratum; AWS fixes do not establish Red Hat remediation. |
Use the guidance for your product and release branch. Confirm distribution backports with the vendor; the product name alone does not establish exposure.
Vendors warn of possible remote code execution on affected IPv4 TCP listeners. Active exploitation is not established. Review exposed hosts first and follow distributor guidance; this weekly priority does not define a safe waiting period.
Include hosts running agent workloads in the kernel inventory. This vulnerability is not specific to AI agents, and the reviewed sources do not establish an AI-driven attack.
Added IPv4/TCP kernel scope, upstream branch corrections and separate Amazon Linux and Red Hat response guidance.
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
Check affected systems and versions, then record your decision below. If you are unsure, choose “Needs verification”.
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
Record distribution, package build, running kernel and reachable IPv4 TCP listeners. Include container hosts. Match distributor packages and backports rather than treating every Linux installation as affected.
Apply the applicable AL2 or AL2023 kernel security update and reboot. Verify the running kernel afterward against the distributor advisory; an installed package alone does not prove the correction is active.
AWS identifies EKS-optimized AL2023 AMIs v20261031 and ECS-optimized AMIs 20261031 as corrected. Check actual nodes, their replacement and workload health. An updated launch template does not replace existing instances.
Use the erratum for the installed RHEL or OpenShift product and branch. Red Hat says fixes are being expedited. Keep unresolved package availability visible and verify the active kernel after remediation.
Red Hat describes IP-options filtering as exposure reduction, not a complete fix. Test compatibility before changing network rules and record remaining exposure, the remediation owner and the applicable update.
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Compare the running version and configuration with the vendor guidance.
| Product | Affected | Fixed release / action |
|---|---|---|
| Linux upstream branches | Affected code introduced in 4.4; check the correction for each maintained branch. Distributor backports can use different version numbers. | 5.10.2725.15.2236.1.1906.6.1596.12.1136.18.567.2.107.3 |
| Amazon Linux 2 / Amazon Linux 2023 | Installed kernels without the applicable CVE-2026-98432 security update. | Apply the branch-specific kernel update and reboot. Verify the running kernel against the Amazon Linux advisory. |
| EKS / ECS on EC2 | Instances running affected host kernels; a corrected image configuration alone does not update existing nodes. | EKS-optimized AL2023 AMI v20261031ECS-optimized AMI 20261031Replace affected nodes or apply the supported kernel update and reboot. |
| RHEL 8 / 9 / 10 and OpenShift | Vulnerable underlying kernels identified by Red Hat, including layered products. | Corrections are being expedited. Check the applicable product and branch erratum; AWS fixes do not establish Red Hat remediation. |
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Vendors warn of possible remote code execution on affected IPv4 TCP listeners. Active exploitation is not established. Review exposed hosts first and follow distributor guidance; this weekly priority does not define a safe waiting period.
Prioritization criteriaCatalog 2026.10.29 · Checked Oct 30, 2026 UTC
No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.
| Product / CVE | Attack evidence | Source guidance |
|---|---|---|
| Linux kernelCVE-2026-98432 | Attacks not established The reviewed evidence does not establish whether this vulnerability was used in attacks. | Linux sourceReview affected systems |
Forecast unavailable. This is not a zero score.
FIRST EPSS · Checked 2026-10-27 15:30 UTC
Priority applies to the parent advisory, not separately to every product or CVE. Each row shows only the evidence attributed to that CVE. Missing attack evidence does not mean a vulnerability is safe to ignore. Your environment has not been scanned.
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
| Product / service | Linux kernel IPv4/TCPLinux |
|---|---|
| CVE | CVE-2026-98432 |
| Exploitation evidence | Attacks not established |
| Access required | No login required |
| Fix / response | Additional action requiredAffected versions and fixes |
Include hosts running agent workloads in the kernel inventory. This vulnerability is not specific to AI agents, and the reviewed sources do not establish an AI-driven attack.