blog

For several days now, Linux has been affected by CVE-2026-98432. This appears to be a race condition which might occur when new TCP connections are established, and in the end might lead to a full root-level compromise of the affected system. The problem appears to have been known since October 15th; however, as of today – October 30th – the corresponding overview on hacker news still reports no patches available for Ubuntu and Red Hat systems. While Red Hat seems to rate the issue at up to 8.1, Ubuntu has assigned a 9.8 critical rating. Since I'm also administering a few Ubuntu systems which were not to be shut down in the meantime, I applied a few mitigations to bridge the gap until patches are available.

AWS recommends disabling MPTCP. If the command sysctl net.mptcp.enabled returns a value of 1, one can disable it using

sysctl -w net.mptcp.enabled=0

This will take effect immediately, but won't survive a reboot. This can be achieved by creating the following file:

/etc/sysctl.d/cve-2026-98432.conf

net.mptcp.enabled = 0

Red Hat recommends filtering IPv4 packets containing IP options. This works by creating a corresponding rule in a file as follows:

cve-2026-98432.nft

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

This file can be checked and applied by

sudo nft --check --file cve-2026-98432.nft
sudo nft --file cve-2026-98432.nft
sudo nft list table inet cve_2026_98432

In order to make it persistent over reboots, it should be integrated into /etc/nftables.conf accordingly, where it should be applied both in “input” and “forward”.