blog

For several days now, Linux has been affected by CVE-2026-98432. This appears to be a race condition which might occur when new TCP connections are established, and in the end might lead to a full root-level compromise of the affected system. The problem appears to have been known since October 15th; however, as of today – October 30th – the corresponding overview on hacker news still reports no patches available for Ubuntu and Red Hat systems. Ubuntu has assigned a 9.8 critical rating. Since I'm also administering a few Ubuntu systems which were not to be shut down in the meantime, I applied a few mitigations to bridge the gap until patches are available.

AWS recommends disabling MPTCP. If the command sysctl net.mptcp.enabled returns a value of 1, one can disable it using

sysctl -w net.mptcp.enabled=0

This will take effect immediately, but won't survive a reboot. This can be achieved by creating the following file:

/etc/sysctl.d/cve-2026-98432.conf

net.mptcp.enabled = 0

Red Hat recommends filtering IPv4 packets containing IP options. This works by creating a corresponding rule in a file as follows:

cve-2026-98432.nft

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

This file can be checked and applied by

sudo nft --check --file cve-2026-98432.nft
sudo nft --file cve-2026-98432.nft
sudo nft list table inet cve_2026_98432

In order to make it persistent over reboots, it should be integrated into /etc/nftables.conf accordingly, where it should be applied both in “input” and “forward”.