View a markdown version of this page

Address CVE-2026-98432 on Linux-based Lightsail instances - Amazon Lightsail
What is CVE-2026-98432Affected instancesBefore you beginMitigation stepsAdditional resources

Address CVE-2026-98432 on Linux-based Lightsail instances

Amazon Lightsail is the easiest way to get started with Amazon Web Services (AWS) for anyone who needs to build websites or web applications. With Lightsail, you can create instances (virtual private servers) from Linux operating system and application blueprints. This page explains how to protect those instances from CVE-2026-98432, a vulnerability in the Linux kernel.

Lightsail does not update the operating system on your instances after you create them. You are responsible for installing operating system and kernel updates. For more information, see Update your Lightsail instances and containers.

This page contains the following sections:

What is CVE-2026-98432

CVE-2026-98432 is a use-after-free flaw in the Linux kernel code that sets up incoming IPv4 TCP connections. A remote attacker can trigger it by sending TCP connection requests that carry IPv4 options to any listening IPv4 TCP port. No credentials or user interaction are needed. The Linux kernel CVE team rates this issue Critical, with a CVSS v3.1 score of 9.8. Operating system vendors rate it between Important and Critical.

To fix the issue, install a patched kernel from your operating system vendor and reboot the instance. Until a patched kernel is available, you can apply a temporary firewall rule that blocks the traffic that triggers the flaw. For details, see Mitigation steps.

Affected instances

The flaw affects Linux kernel 4.4 and later, so most Linux-based instances are affected. This includes instances created from the following blueprints:

  • AlmaLinux OS 9, CentOS Stream 9, Debian, openSUSE Leap, and Ubuntu operating system blueprints.

  • Application blueprints, such as WordPress, LAMP, Node.js, and Plesk. These blueprints run on a Linux distribution such as Debian or Ubuntu, so follow the guidance for that distribution.

  • Amazon Linux 2023 and Amazon Linux 2 blueprints. For instructions specific to Amazon Linux, see Update Amazon Linux on Lightsail instances.

All versions of these blueprints are affected, including the latest versions available in Lightsail. Instances that you created earlier are affected until you install a patched kernel.

Instances created from FreeBSD and Windows Server blueprints are not affected, because they don't use the Linux kernel.

Before you begin

Before you change the kernel or the firewall on your instance, create a snapshot of it. If something goes wrong, you can create a new instance from the snapshot. For more information, see Back up Linux/Unix Lightsail instances with snapshots.

To find which operating system and kernel your instance runs, connect to it using SSH and run the following commands. For more information, see Connect to Linux or Unix instances on Lightsail.

cat /etc/os-release
uname -r

The first command shows the distribution name and version. The second command shows the kernel version that is running.

Mitigation steps

Use the following options to protect your instance. The option that you use depends on the blueprint that your instance was created from, and on whether your operating system vendor has published a patched kernel.

Option Applies to

Install a kernel update (complete fix)

Instances created from any Linux-based blueprint, after the operating system vendor publishes a patched kernel. Patched kernels are available for the Amazon Linux 2023 and Amazon Linux 2 blueprints.

Apply a temporary firewall rule (interim fix)

Instances created from the AlmaLinux OS 9, CentOS Stream 9, Debian, openSUSE Leap, and Ubuntu blueprints, and from application blueprints that run on these distributions, until a patched kernel is available.

Restrict ports with the Lightsail firewall (reduces exposure)

Instances created from any Linux-based blueprint.

Install a kernel update

This option applies to instances created from any Linux-based blueprint. Installing a patched kernel is the only complete fix.

For instances created from the Amazon Linux 2023 and Amazon Linux 2 blueprints, patched kernels are available. For the steps, see Update Amazon Linux on Lightsail instances.

For instances created from other Linux-based blueprints, each operating system vendor publishes its own fixed kernel versions and release schedule. Check your vendor's security advisory to find out whether a fixed kernel is available for your version, and follow the vendor's instructions to install it. If a fixed kernel isn't available yet, apply the temporary firewall rule.

Operating system Security advisory
AlmaLinux OS

CVE-2026-98432 on the AlmaLinux blog
CentOS Stream

No advisory has been published. Check the CentOS Stream website for updates.
Debian

CVE-2026-98432 in the Debian security tracker
openSUSE

CVE-2026-98432 on the SUSE website
Ubuntu

CVE-2026-98432 on the Ubuntu website

Every kernel update requires a reboot. After you install the update, reboot the instance, and then run uname -r to confirm that it runs the fixed kernel version listed in your vendor's advisory.

Note

Debian 11 and openSUSE Leap 15 have reached end of support and might not receive a kernel update. If your instance runs one of these versions, apply the temporary firewall rule, and plan to move your workload to an instance that runs a supported version.

Apply a temporary firewall rule

This option applies to instances created from the AlmaLinux OS 9, CentOS Stream 9, Debian, openSUSE Leap, and Ubuntu blueprints, and from application blueprints that run on these distributions. For instances created from the Amazon Linux 2023 and Amazon Linux 2 blueprints, install the kernel update instead.

If a patched kernel isn't available for your operating system yet, or you can't reboot the instance right away, you can apply a temporary firewall rule. The flaw can only be triggered by an incoming IPv4 TCP packet that carries IPv4 options. Regular traffic almost never uses IPv4 options, so dropping these packets blocks the trigger without affecting normal connections.

Important

Create a snapshot of your instance before you apply the rule. For more information, see Back up Linux/Unix Lightsail instances with snapshots. This rule is not a fix. Install a patched kernel as soon as one is available for your operating system.

The command to use depends on your operating system. The AlmaLinux OS 9 and CentOS Stream 9 kernels don't include the u32 match that the iptables rule uses, so use the nft rule on those instances instead.

Debian, Ubuntu, and openSUSE instances

  1. Create a snapshot of your instance as a backup.

  2. Connect to your instance using SSH. For more information, see Connect to Linux or Unix instances on Lightsail.

  3. Confirm that the iptables command is installed:

    sudo iptables --version

    If the command isn't found, install it. On Debian and Ubuntu, run sudo apt install -y iptables. On openSUSE, run sudo zypper install -y iptables.

  4. Add a rule that drops incoming IPv4 TCP packets that carry IPv4 options:

    sudo iptables -I INPUT 1 -p tcp -m u32 --u32 '0>>24&0x0f=6:15' -j DROP

    The u32 expression reads the IPv4 header length field. A value greater than 5 means the packet carries IPv4 options.

  5. Confirm that the rule is active:

    sudo iptables -L INPUT -n -v --line-numbers

    The first rule in the output is a DROP rule with u32 "0x0>>0x18&0xf=0x6:0xf". The pkts column shows how many packets the rule has dropped.

To remove the rule after you install a patched kernel, run the following command:

sudo iptables -D INPUT -p tcp -m u32 --u32 '0>>24&0x0f=6:15' -j DROP

AlmaLinux OS and CentOS Stream instances

  1. Create a snapshot of your instance as a backup.

  2. Connect to your instance using SSH. For more information, see Connect to Linux or Unix instances on Lightsail.

  3. Confirm that the nft command is installed:

    sudo nft --version

    If the command isn't found, install it:

    sudo dnf install -y nftables

  4. Add a rule that drops incoming IPv4 TCP packets that carry IPv4 options. This rule is provided by AlmaLinux. It works alongside firewalld, and it's safe to run more than once.

    sudo nft -f - <<'EOF'
add table ip cve_2026_98432
delete table ip cve_2026_98432
table ip cve_2026_98432 {
    chain prerouting {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength > 5 counter drop
    }
}
EOF

  5. Confirm that the rule is active:

    sudo nft list table ip cve_2026_98432

    The counter in the output shows how many packets the rule has dropped.

To remove the rule after you install a patched kernel, run the following command:

sudo nft delete table ip cve_2026_98432

Limitations of the temporary rule

  • The rule doesn't persist after a reboot. If you reboot the instance before you install a patched kernel, run the command again.

  • The rule drops all incoming IPv4 TCP packets that carry IPv4 options. If an application on your instance relies on IPv4 options, such as CIPSO security labels, don't use this rule.

  • IPv6 traffic is not affected by the main issue and doesn't need the rule.

Restrict ports with the Lightsail firewall

This option applies to instances created from any Linux-based blueprint. Use it together with a kernel update or the temporary firewall rule.

An attacker can only trigger the flaw through an IPv4 TCP port that is open to them. You can reduce exposure with the Lightsail instance firewall: close the ports that you don't need, and limit the remaining ports to trusted IP addresses. If you close all IPv4 TCP ports, the traffic can't reach the instance, but you also can't connect to it, including with SSH. For more information, see Control instance traffic with firewalls in Lightsail.

Additional resources