# Linux IPv4/TCP: check exposed kernels for CVE-2026-98432 Canonical: https://www.oktsec.com/radar/linux-kernel-cve-2026-98432 Publisher: Oktsec Language: en Published: 2026-11-01T19:45:56Z Updated: 2026-11-01T19:45:56Z Record reviewed: 2026-11-01T19:45:56Z Latest evidence check: 2026-11-01T19:45:56Z Disclosed: 2026-10-15 A race in Linux IPv4/TCP connection handling can corrupt kernel memory, with possible remote code execution without authentication. Check the running kernel and distributor advisory, then activate the applicable correction; active exploitation is not established. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: Vendors warn of possible remote code execution on affected IPv4 TCP listeners. Active exploitation is not established. Review exposed hosts first and follow distributor guidance; this weekly priority does not define a safe waiting period. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Additional action required - Exposure requirement: No login required - Vendor: Linux - Products: Linux kernel IPv4/TCP - CVEs: CVE-2026-98432 ## Technical overview During TCP connection handling, one CPU can free socket options while another still reads them. The Linux CNA correction defers freeing until an RCU grace period has passed. Request-socket migration has a related lifetime problem; disabling migration alone does not establish that a host is protected. The CNA records affected code from Linux 4.4 and branch fixes at 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. These are upstream boundaries. Distributor backports require package-specific evidence. AWS reports Amazon Linux 2/2023 kernel corrections and requires an update and reboot. EKS and ECS operators must verify the instances running corrected images. EKS Auto Mode replacement is subject to disruption budgets; the rollout target is not confirmation that every node has changed. Bottlerocket availability remains a November 2 target in the reviewed bulletin. Red Hat lists RHEL 8/9/10 and OpenShift and says it is expediting fixes. Its bulletin does not establish that every affected branch has a released correction. AWS versions cannot establish Red Hat remediation. Amazon Linux rates this CVE 8.1; Red Hat lists a preliminary 9.8. The assessments differ on attack complexity, so this record does not collapse them into one score. Possible remote code execution is not evidence of attacks in the wild. The Linux CNA published the record on October 15. This advisory is separate from CVE-2026-46300, which concerns local escalation and the PHP2Shell chain; that record's exploitation evidence does not apply here. ## Recommended response Identify affected running kernels and reachable listeners. Apply the correction for the installed distribution and branch, reboot where required, and verify the active kernel or replacement nodes. Relevant to: Teams operating Linux hosts or container nodes that accept IPv4 TCP connections, including Amazon Linux 2/2023, RHEL 8/9/10, EKS, ECS and OpenShift operators. ## CVE attribution - CVE-2026-98432: Linux — Linux kernel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98432.json) ## Affected systems and fixes ### Linux upstream branches Affected: Affected code introduced in 4.4; check the correction for each maintained branch. Distributor backports can use different version numbers. Fixed release / action: 5.10.272; 5.15.223; 6.1.190; 6.6.159; 6.12.113; 6.18.56; 7.2.10; 7.3 ### Amazon Linux 2 / Amazon Linux 2023 Affected: Installed kernels without the applicable CVE-2026-98432 security update. Fixed release / action: Apply the branch-specific kernel update and reboot. Verify the running kernel against the Amazon Linux advisory. ### EKS / ECS on EC2 Affected: Instances running affected host kernels; a corrected image configuration alone does not update existing nodes. Fixed release / action: EKS-optimized AL2023 AMI v20261031; ECS-optimized AMI 20261031; Replace affected nodes or apply the supported kernel update and reboot. ### RHEL 8 / 9 / 10 and OpenShift Affected: Vulnerable underlying kernels identified by Red Hat, including layered products. Fixed release / action: Corrections are being expedited. Check the applicable product and branch erratum; AWS fixes do not establish Red Hat remediation. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.29 Checked: 2026-10-30T10:27:08.428Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-98432 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Identify affected running kernels** — Record distribution, package build, running kernel and reachable IPv4 TCP listeners. Include container hosts. Match distributor packages and backports rather than treating every Linux installation as affected. 2. **Update Amazon Linux and reboot** — Apply the applicable AL2 or AL2023 kernel security update and reboot. Verify the running kernel afterward against the distributor advisory; an installed package alone does not prove the correction is active. 3. **Replace affected EKS and ECS nodes** — AWS identifies EKS-optimized AL2023 AMIs v20261031 and ECS-optimized AMIs 20261031 as corrected. Check actual nodes, their replacement and workload health. An updated launch template does not replace existing instances. 4. **Check the Red Hat branch separately** — Use the erratum for the installed RHEL or OpenShift product and branch. Red Hat says fixes are being expedited. Keep unresolved package availability visible and verify the active kernel after remediation. 5. **Validate temporary traffic filtering** — Red Hat describes IP-options filtering as exposure reduction, not a complete fix. Test compatibility before changing network rules and record remaining exposure, the remediation owner and the applicable update. ## Relevance to AI environments Include hosts running agent workloads in the kernel inventory. This vulnerability is not specific to AI agents, and the reviewed sources do not establish an AI-driven attack. ## Sources - [AWS 2026-160: Amazon Linux, EKS and ECS remediation](https://aws.amazon.com/security/security-bulletins/2026-160-aws/) — AWS; Vendor notice; checked 2026-11-01T19:45:56Z - [Linux CNA: IPv4/TCP mechanism and upstream branch fixes](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98432.json) — Linux; Vendor notice; checked 2026-11-01T19:45:56Z - [Amazon Linux: affected packages and CVSS assessment](https://explore.alas.aws.amazon.com/CVE-2026-98432.html) — Amazon Linux; Vendor notice; checked 2026-11-01T19:45:56Z - [Red Hat: affected products and mitigation limits](https://access.redhat.com/security/vulnerabilities/RHSB-2026-016) — Red Hat; Vendor notice; checked 2026-11-01T19:45:56Z - [Red Hat: CVE assessment and preliminary severity](https://access.redhat.com/security/cve/CVE-2026-98432) — Red Hat; Vendor notice; checked 2026-11-01T19:45:56Z ## Editorial record - 2026-11-01T19:45:56Z: Added IPv4/TCP kernel scope, upstream branch corrections and separate Amazon Linux and Red Hat response guidance. ## Related incidents - [Linux: patch the kernel used by the PHP2Shell escalation chain](https://www.oktsec.com/radar/linux-kernel-cve-2026-46300) ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/linux-kernel-cve-2026-98432) · [Build a response plan](https://www.oktsec.com/radar/linux-kernel-cve-2026-98432#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=linux-kernel-cve-2026-98432&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=linux-kernel-cve-2026-98432&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.