CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue
Bulletin ID: 2026-160-AWS Publication Date: 10/30/2026 22:15 PM PDT Description: AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later that could result in remote code execution. Updated kernel packages are available for Amazon Linux 2 and Amazon Linux 2023, and we recommend customers running self-managed Linux instances update and reboot. AWS is applying updates to managed services and no customer action is required for those services. For full details and per-service guidance, see the complete bulletin at https://aws.amazon.com/security/security-bulletins/2026-160-aws/ Please refer to the article below for the mos
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, Linux kernel
- Product
- Linux kernel, AWS services
- EPSS
- 0.004 (p39)
- Exposure class
- Operating system, Cloud platform
Why it ranks 37 (Notable)
- Product class: operating system, cloud platform
- Widely deployed vendor product (Amazon Web Services)
- Covered by 3 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-98432 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.