Advisoriesby IbisLinux kernel IPv4 TCP use-after-free Issue
Bulletin ID: 2026-160-AWS Publication Date: 10/30/2026 22:15 PM PDT Description: AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later that could result in remote code execution. Updated kernel packages are available for Amazon Linux 2 and Amazon Linux 2023, and we recommend customers running self-managed Linux instances update and reboot. AWS is applying updates to managed services and no customer action is required for those services. For full details and per-service guidance, see the complete bulletin at https://aws.amazon.com/security/security-bulletins/2026-160-aws/ Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
Changes since it was listed
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- NVD
More AWS advisories
All AWS
Insertion of sensitive information into a log file and process argument list in the...CVE-2026-119117no fix yetMissing type validation in xQueueSelectFromSet in FreeRTOS-KernelCVE-2026-119086no fix yetIssues in AWS Nitro Enclaves SDK for CCVE-2026-119116no fix yetIncorrect authorization in issuer resolution in AWS Private CA Connector for KubernetesCVE-2026-119115no fix yetNative Brotli Decoder Remote Code Execution and Memory DisclosureCVE-2026-111497no fix yetSecret masking bypass in the environment tool in Strands Agents ToolsCVE-2026-115415no fix yet