Skip to main content
Last updated: 2026-10-30 CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP code. A peer that can reach a listening IPv4 TCP socket can trigger it before the application sees the connection. The kernel CNA rates it CVSS 3.1 9.8. A remote root exploit against a server with a Multipath TCP (MPTCP) listener has been demonstrated but not published. The Go team notes that the underlying bug is not specific to MPTCP. We are not aware of reports of exploitation in the wild. The bug is in the host’s Linux kernel, which comes from AWS, Google or an image you choose, not from Aspect Workflows. Container images run on the host kernel and need no changes. Every Linux host in an Aspect Workflows 5.17 through 6.1 deployment on AWS or GCP runs an affected kernel until it is patched, including CI runners. Windows hosts are not affected. Public traffic reaches Workflows through Layer 7 load balancers, so the internet can’t reach a Workflows host’s TCP stack directly. The risk comes from code running inside your network, such as a malicious CI job from a fork pull request or a poisoned dependency.

​
What we recommend

  • Limit which sources in your network can reach the remote cache, BES and Postgres hosts. CI runners are the main source of untrusted traffic.
  • On AWS ECS, re-apply your deployment once AWS publishes a patched Amazon Linux 2023 ECS-optimized AMI, then replace the remote cache and executor instances yourself. Their Auto Scaling groups don’t refresh instances. To patch sooner, set remote.storage.instance_image_id for remote cache hosts or ec2.instance_image for each executor worker to an AMI you choose.
  • The Ivy BEP hosts are replaced by instance refresh when you re-apply.
  • The Ivy Postgres host on 6.0.0 through 6.0.39 is also replaced when you re-apply. From 6.0.40 the module pins it to an AMI that predates the fix, so set bes.db.ami_id to a patched AMI. Replacing it causes downtime, so schedule it.
  • On GKE, the remote cache and executor node pools don’t auto-upgrade. Upgrade them after Google ships a patched node version. Each upgrade empties the node’s local SSD cache, so do it outside peak CI hours.
  • Other GKE node pools follow Google’s upgrades. Confirm they run the patched image and replace any nodes that don’t.
  • As a stopgap, you can turn off MPTCP with net.mptcp.enabled=0 on hosts and GODEBUG=multipathtcp=0 on Go services. This blocks the demonstrated exploit but leaves the bug in place, and the Go team calls the GODEBUG route fragile.

​
CI runner images

  • You choose the CI runner image through the runner image_id setting. We recommend you check your CI runner AMIs and GCP images and rebuild them on a fixed kernel per your company policies.
  • Debian 12: fixed in linux 6.1.190-1 (DLA-4841-1) and linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1).
  • Ubuntu 24.04: no fix released yet. Canonical lists linux, linux-aws, linux-gcp and linux-gke as vulnerable with work in progress, targeting linux 6.8.0-149.149, linux-aws 6.8.0-1069.74 and linux-gke 6.8.0-1068.77.
  • Aspect-provided Ubuntu 24.04 starter images, including those dated 20261021-0, are affected. Debian 12 starter images dated 20261021-0 are also affected. See workflows-images.

​
Pending vendor fixes

As of 2026-10-30:
  • Amazon Linux 2023 kernel (6.1), used by the ECS-optimized AMIs: pending fix. Amazon Linux 2023 kernel6.12 and kernel6.18 are fixed.
  • Ubuntu 24.04: no fix released.
  • GKE Container-Optimized OS: the current stable release runs fixed kernel 6.6.159. No GKE security bulletin for this CVE.

​
References