AWS patches new Fargate tasks for Linux flaw exposed by Claude research

AWS has released a corrected Fargate platform for a Linux flaw exploited in Claude security research. Its November 1 bulletin says new container tasks launched after 17:00 UTC that day use the patched platform. Existing tasks follow their retirement settings.

A new platform release and the replacement of a running workload happen separately. AWS’s maintenance documentation says existing tasks remain on their original revision throughout their lifetime. They move onto a newer revision when replaced. Retirement notices identify affected workloads and dates through AWS Health and the account’s registered email.

The flaw is CVE-2026-98432. In research published October 27, Anthropic said an unreleased internal model found vulnerabilities and developed exploits. Its Linux demonstration reached root command execution on a server accepting Multipath TCP connections. The company reported 48 minutes to obtain a kernel pointer and another five minutes to execute a command. It said the flaw was fixed upstream and backported to maintained stable branches.

Red Hat describes a memory-lifetime error in IPv4 connection handling: one operation frees information while another still uses it. Consequences include a crash or memory corruption. Its advisory identifies RHEL 8, 9 and 10 and OpenShift as affected and says fixes are being expedited. Filtering affected traffic can reduce exposure but may disrupt workloads and does not substitute for kernel security updates.

AWS said in its November 1 bulletin that it was not aware of exploitation in the wild. The documented research demonstration and vendor remediation remain distinct from evidence of an actual attack.

Installing a correction and replacing the running system

For customers managing their own servers, a corrected kernel also needs to become active. The Amazon Linux 2 advisory, updated November 2, supplies a correction through its Core repository and explicitly requires a system reboot to complete the update. Downloading a package and running its corrected kernel are separate stages.

The Amazon Linux 2023 advisory, also updated November 2, specifies release 2023.12.20261102 for receiving the correction. Its package list includes kernel build 6.1.189-236.400 for both aarch64 and x86_64. These distribution-specific identifiers matter when a system is pinned to a particular release.

Fargate retirement also distinguishes service tasks from standalone tasks. The ECS scheduler replaces tasks belonging to a service, with deployment settings controlling the order of replacement and shutdown. A stopped standalone task is not automatically recreated by ECS; customers manage its continuation.

ECS Managed Instances follow a different lifecycle. Their documentation describes draining from day 14 after launch and termination no later than day 21. Security vulnerabilities, hardware health and maintenance windows can bring draining forward. Service deployment settings continue to govern workload replacement during that process.

Distribution package numbers differ for the same flaw. Debian’s tracker marks Bookworm security package 6.1.190-1 and Trixie security package 6.12.113-1 as fixed. Those identifiers do not provide a universal threshold for Amazon Linux builds; correction status belongs to the particular distribution and package branch.

When checked by AI Ping on November 2, Ubuntu’s tracker still marked the base linux package for 22.04, 24.04, 26.04 and 26.10 as vulnerable with work in progress. The page is dated October 30. Cloud and hardware kernel variants have separate entries and correction statuses.