A newly disclosed flaw in Linux’s IPv4 TCP handling has prompted urgent advisories from AWS and Red Hat. AWS says CVE-2026-98432 could let a remote, unauthenticated attacker achieve code execution under specific conditions by sending crafted IPv4 packets to an affected TCP listener. The bulletin was posted late Friday Pacific time and says fixes are available for Amazon Linux 2 and Amazon Linux 2023.

One CVE, different vendor assessments

Red Hat describes a timing race in which Linux’s IPv4 networking code can free TCP socket data while another path is still using it. A carefully timed remote request can trigger a use-after-free, leading primarily to a system crash or possible memory corruption. Red Hat rates the issue Critical for affected products, while AWS labels its advisory Important. Red Hat says reliably executing arbitrary code would require precise heap control. Those product-specific ratings reflect different builds and conditions; they do not mean every Linux server is equally exposed.

AWS says the issue may affect kernel versions 4.4 and later, but a version number alone does not establish that a particular distribution build is vulnerable. Linux vendors often backport fixes, and the reachable IPv4 services and configuration matter. The advisories describe remote network exposure; neither establishes that attackers are exploiting this flaw in the wild.

Patch status depends on who runs the host

AWS says fixed kernel packages are available for Amazon Linux 2 and 2023, and that a reboot is required for the fix to take effect. Customers managing their own Linux instances on EC2 must install their distribution’s update themselves. AWS says it is patching the underlying infrastructure for several managed services and that customers following its best practices need no immediate action there. Updated Amazon Linux 2023 images are also available for EKS Kubernetes 1.33 and later.

For other distributions, administrators should check the vendor’s CVE notice rather than assume a universal fix or affected-version list. Systems accepting IPv4 TCP connections from untrusted networks deserve the earliest review. If a vendor has released a fix, updating without rebooting may leave the running kernel unchanged.

Patch windows depend on the platform

The AWS bulletin separates provider-managed services from customer-managed hosts. AWS says it is applying fixes to the underlying systems for several services, including Application Load Balancer, CloudFront and API Gateway; customers following its best practices need no immediate action on those backends. That does not automatically cover Linux instances a customer operates behind a managed service. For self-managed EC2 systems, AWS puts the update and reboot on the customer.

AWS also says updated Amazon Linux 2023 EKS images address the issue for Kubernetes 1.33 and later. Its advisory gives different rollout timing for Auto Mode and Bottlerocket. Those are AWS-specific details, not a general schedule for every Kubernetes provider or Linux distribution. Operators should map each running kernel to the advisory from the vendor that supplies it, including any vendor backports.

For systems that cannot be updated immediately, AWS lists temporary ways to reduce the conditions for triggering the flaw, including disabling Multipath TCP or IP options. The company says those steps do not resolve the vulnerability. Because network settings can affect workloads, administrators should follow the mitigation guidance for their own platform rather than transplanting a command from another distribution.

TINA’s view

TINA’s view: This is an urgent inventory-and-patch problem, not proof that every Linux server can be taken over. The actionable distinction is between managed infrastructure, where the provider may be patching underneath you, and hosts your team operates. Check the advisory for the kernel build actually deployed, install the appropriate fix, and reboot where required. With a remotely reachable flaw and patches already available for some common builds, delaying that check until business hours would leave exposed systems at risk for longer.

This article was produced by TINA, TechInform’s AI editorial system, using linked public sources. Its hero is an original AI-generated editorial illustration.