AWS ships kernel fixes for the TCP flaw and dates RDS and Redshift patches

AWS ships kernel fixes for the TCP flaw and dates RDS and Redshift patches

30 October 2026: AWS has released Amazon Linux 2 and Amazon Linux 2023 kernels that fix CVE-2026-98432, the use-after-free in the Linux kernel's IPv4 TCP handshake path that its bulletin says can let "a remote, unauthenticated third party" run code by sending crafted packets to a listening port. Its own managed services are being patched on a schedule that runs to 3 November, and on self-managed EC2 and Lightsail hosts the fix is the customer's job: a kernel update and a reboot.

Not yet independently verified. This rests on the AWS bulletin, which AWS says it will keep updating. The dates for Bottlerocket, Redshift, RDS, Aurora and Storage Gateway are AWS's expected dates, not releases we have seen. We will update this when it can be confirmed, and remove this note.

We covered the flaw itself, and Debian's fixed kernels, in our earlier advisory. The AWS bulletin, published late on 30 October and updated the next day, is the first detailed vendor timetable for a large cloud estate.

Amazon Linux kernels are out now

AWS lists fixed packages for kernel-4.14, 5.4, 5.10, 5.15, 6.1, 6.12 and 6.18, all available now. The commands it gives are sudo yum update kernel && sudo reboot on Amazon Linux 2 and sudo dnf update kernel --releasever=latest && sudo reboot on Amazon Linux 2023. AWS stresses that "a kernel update and reboot is the only complete remediation for this issue", so a host that has pulled the package but not restarted is still exposed.

For other distributions on EC2, AWS points customers to their own vendor. Canonical's page for the CVE, updated on 30 October, still shows Ubuntu 26.10, 26.04, 24.04 and 22.04 as vulnerable with fixes in progress, and 20.04, 18.04 and 16.04 as vulnerable.

The managed-service timetable

The bulletin splits AWS services into those already covered and those still to come:

• EKS: EKS-optimised Amazon Linux 2023 AMIs from release v20261031 carry the fix; managed node groups, self-managed nodes and Karpenter users must move to them. Auto Mode replaces nodes automatically, within NodePool disruption budgets.
• ECS: the ECS-optimised AMI release 20261031 is fixed. Fargate tasks launched after 13:00 UTC on 1 November use a patched platform version; older tasks retire on the customer's retirement settings unless replaced sooner.
• Bottlerocket: patched AMIs expected from 2 November.
• Redshift: mitigations deploying now, cluster OS patch on Monday 2 November.
• RDS and Aurora: mitigations deploying now, database OS patch on Tuesday 3 November. Customers are told to make sure database ports are not reachable from the internet.
• Storage Gateway: an update expected from 3 November.
• Lambda: not affected, because functions expose no public IPv4 TCP port.

Behind a load balancer is not the same as patched

AWS says customers behind WAF, Application Load Balancer, Classic Load Balancer, TLS listeners on Network Load Balancer, CloudFront and API Gateway do not receive TCP connections from untrusted sources directly, and that it is patching those services itself. It still recommends updating the instances behind them within 30 days. Network Load Balancer TCP listeners and Global Accelerator are listed apart from that group: AWS tells customers there to move to patched platform versions as they become available.

The practical order for an AWS estate is to patch and reboot anything with a public IPv4 TCP listener first, roll EKS and ECS nodes onto the 31 October AMIs, then plan the RDS, Aurora and Redshift maintenance windows for 2 and 3 November. Ubuntu hosts wait on Canonical; until its kernel ships, the bulletin's interim steps are disabling MPTCP (net.mptcp.enabled=0) and dropping IPv4 packets that carry IP options with an iptables or Network Firewall rule, and AWS is clear that they reduce the risk without resolving it. A livepatch, it adds, does resolve it.

Related on TrustList:

• .NET out-of-band update fixes Brotli overflow and tarball flaw
• musl libc fixes regcomp overflows that can corrupt the heap
• AWS CDK fixes a symlink flaw in Docker asset bundling in 2.267.0

Sources

• AWS security bulletin 2026-160-AWS: CVE-2026-98432, Linux kernel IPv4 TCP use-after-free issue, 30 October 2026
• Ubuntu: CVE-2026-98432 (updated 30 October), 30 October 2026