> ## Documentation Index
> Fetch the complete documentation index at: https://aspect.build/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE-2026-98432 Linux kernel IPv4 use-after-free

Last updated: 2026-10-30

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code. A peer that can reach a listening IPv4 TCP socket can trigger it before the application sees the connection. The kernel CNA rates it CVSS 3.1 9.8. A remote root exploit against a server with a Multipath TCP (MPTCP) listener has been demonstrated but not published. The Go team notes that the underlying bug is not specific to MPTCP.

We are not aware of reports of exploitation in the wild.

The bug is in the host's Linux kernel, which comes from AWS, Google or an image you choose, not from Aspect Workflows. Container images run on the host kernel and need no changes.

Every Linux host in an Aspect Workflows 5.17 through 6.1 deployment on AWS or GCP runs an affected kernel until it is patched, including CI runners. Windows hosts are not affected.

Public traffic reaches Workflows through Layer 7 load balancers, so the internet can't reach a Workflows host's TCP stack directly. The risk comes from code running inside your network, such as a malicious CI job from a fork pull request or a poisoned dependency.

## What we recommend

* Limit which sources in your network can reach the remote cache, BES and Postgres hosts. CI runners are the main source of untrusted traffic.
* On AWS ECS, re-apply your deployment once AWS publishes a patched Amazon Linux 2023 ECS-optimized AMI, then replace the remote cache and executor instances yourself. Their Auto Scaling groups don't refresh instances. To patch sooner, set `remote.storage.instance_image_id` for remote cache hosts or `ec2.instance_image` for each executor worker to an AMI you choose.
* The Ivy BEP hosts are replaced by instance refresh when you re-apply.
* The Ivy Postgres host on 6.0.0 through 6.0.39 is also replaced when you re-apply. From 6.0.40 the module pins it to an AMI that predates the fix, so set `bes.db.ami_id` to a patched AMI. Replacing it causes downtime, so schedule it.
* On GKE, the remote cache and executor node pools don't auto-upgrade. Upgrade them after Google ships a patched node version. Each upgrade empties the node's local SSD cache, so do it outside peak CI hours.
* Other GKE node pools follow Google's upgrades. Confirm they run the patched image and replace any nodes that don't.
* As a stopgap, you can turn off MPTCP with `net.mptcp.enabled=0` on hosts and `GODEBUG=multipathtcp=0` on Go services. This blocks the demonstrated exploit but leaves the bug in place, and the Go team calls the `GODEBUG` route fragile.

## CI runner images

* You choose the CI runner image through the runner `image_id` setting. We recommend you check your CI runner AMIs and GCP images and rebuild them on a fixed kernel per your company policies.
* Debian 12: fixed in `linux` 6.1.190-1 (DLA-4841-1) and `linux-6.12` 6.12.113-1\~deb12u1 (DLA-4850-1).
* Ubuntu 24.04: no fix released yet. Canonical lists `linux`, `linux-aws`, `linux-gcp` and `linux-gke` as vulnerable with work in progress, targeting `linux` 6.8.0-149.149, `linux-aws` 6.8.0-1069.74 and `linux-gke` 6.8.0-1068.77.
* Aspect-provided Ubuntu 24.04 starter images, including those dated `20261021-0`, are affected. Debian 12 starter images dated `20261021-0` are also affected. See [workflows-images](https://github.com/aspect-build/workflows-images).

## Pending vendor fixes

As of 2026-10-30:

* Amazon Linux 2023 `kernel` (6.1), used by the ECS-optimized AMIs: pending fix. Amazon Linux 2023 `kernel6.12` and `kernel6.18` are fixed.
* Ubuntu 24.04: no fix released.
* GKE Container-Optimized OS: the current stable release runs fixed kernel 6.6.159. No GKE security bulletin for this CVE.

## References

* [CVE-2026-98432 (CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-98432)
* [NVD: CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432)
* [oss-security: Go and MPTCP listeners](https://www.openwall.com/lists/oss-security/2026/10/30/1)
* [Anthropic: Discovering vulnerabilities with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)
* [Amazon Linux security center](https://explore.alas.aws.amazon.com/CVE-2026-98432.html)
* [Debian security tracker](https://security-tracker.debian.org/tracker/CVE-2026-98432)
* [Ubuntu CVE page](https://ubuntu.com/security/CVE-2026-98432)
* [GKE security bulletins](https://docs.cloud.google.com/kubernetes-engine/security-bulletins)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.