Vercel patched Linux kernel flaw CVE-2026-98432 on its hosts, and Linux servers you run yourself need a kernel update and reboot

Vercel's security bulletin, last updated November 1, 2026, says Vercel has finished applying Linux kernel security updates for CVE-2026-98432. It describes a kernel flaw in the handling of IPv4 TCP connections where, under specific conditions, an attacker can run code remotely by sending specially crafted network packets. Vercel says the updates cover builds, functions, sandboxes, daemons, CI and control-plane systems, and that you do not need to redeploy, restart workloads or change your configuration. It says Anthropic demonstrated an exploit against servers with a Multipath TCP (MPTCP) listener in an October 27 research report.

AWS Security Bulletin 2026-160-AWS, first published October 30 and last updated November 1, 2026, says the bug is in the Linux kernel's IPv4 TCP handshake path and affects kernel versions 4.4 and later. A remote attacker without credentials could send crafted IPv4 TCP packets that carry IP options to an affected listener, which could crash the kernel, disclose kernel memory or corrupt memory. AWS says researchers have demonstrated remote code execution without authentication against hosts with an MPTCP listener, and that it is not aware of exploitation in the wild. The CVE record, published October 15, 2026, identifies its assigner as Linux and lists fixes in the 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 stable kernels and in 7.3.

Both bulletins say Linux servers you manage yourself need the fix. Vercel names external backends used by applications on Vercel and tells you to apply your distribution's kernel update and follow its activation instructions. AWS says a reboot is required after the kernel update and that an update plus reboot is the only complete remediation. As an interim step until you can patch, AWS lists turning off MPTCP with the kernel setting net.mptcp.enabled=0, or setting GODEBUG=multipathtcp=0 for programs built with Go 1.24 or later, and says this reduces the conditions for running code on a host but does not resolve the issue. Vercel also calls turning off MPTCP an interim mitigation, not a replacement for patching. AWS says Lambda functions are not affected.