# Linux kernel security advisory: CVE-2026-98432

Written by Vercel Security Team

---

_Last updated November 1, 2026._

Vercel has completed the application of Linux kernel security updates to address [CVE-2026-98432](https://www.cve.org/CVERecord?id=CVE-2026-98432). In this kernel vulnerability, certain specific conditions allow an attacker to execute code remotely by sending specially crafted network packets. Patches have been deployed across our compute infrastructure.

## **Recommended actions**

**No action is required for Vercel-managed workloads**

Vercel has automatically applied the kernel updates across builds, functions, sandboxes, daemons, CI, and control-plane systems. You do not need to redeploy, restart workloads, or change your configuration.

**For Linux servers you manage**

If you manage Linux servers yourself, including external backends used by applications on Vercel, apply your distribution’s kernel update and follow its activation instructions.

If you use Amazon Linux, patches are available. AWS instructs customers managing their own instances to update and reboot. Disabling Multipath TCP is an interim mitigation, not a replacement for patching. See the [AWS security bulletin](https://aws.amazon.com/security/security-bulletins/2026-160-aws/) for more information and recommended actions.

## **What Vercel has done**

Our response included validating network protections and updating affected infrastructure:

- **Network protections:** Our testing confirmed that Application Load Balancers prevent the network options required by this attack from reaching backend systems through those connections. TCP-forwarding Network Load Balancers can pass these options through, so affected hosts behind them have been patched and rotated.
  
- **Compute infrastructure:** All hosts and guest kernels have been updated with upstream patches, and all workloads on Vercel are running the updated kernel automatically (including builds, functions, sandboxes, daemons, and CI).
  
- **Control-plane systems:** We have updated the hosts that run our control plane to kernel versions containing the fix.
  

## **Understanding CVE-2026-98432**

The vulnerability affects the Linux kernel’s handling of IPv4 TCP connections. Under specific conditions, this vulnerability allows an attacker to send specially crafted network packets to execute code remotely. Anthropic demonstrated an exploit against servers with a Multipath TCP listener and described its findings in an [October 27 research report](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude#5-zero-click-remote-code-execution-in-linux).

For questions, contact [security@vercel.com](mailto:security@vercel.com).

---

Read our [security guides](/kb/security) to learn about deployment protection, bot prevention, and rate limiting.

Browse [all security bulletins](/kb/bulletin) for security updates and advisories.