Detect CVE-2026-98432 on the running Linux kernel and apply the official fixed kernel only on verified distributions (Debian 12/13, Amazon Linux 2/2023). Ubuntu/RHEL detect-only; Rocky/Alma/Oracle/Fedora/SUSE/Arch/Alpine identified but not auto-fixed.
简体中文 | English
This tool checks whether the kernel currently running on a Linux server is affected by CVE-2026-98432 and, on distributions that have been fully adapted and verified, installs the official fixed kernel package. It covers distribution identification, kernel-to-package mapping, vulnerability assessment, kernel installation, and post-installation verification. It does not modify application configuration and never reboots the server.
Automatic remediation is limited to Debian 12/13 and Amazon Linux 2/2023. Ubuntu, Red Hat Enterprise Linux, and CloudLinux are detection-only: CloudLinux has published fixed packages, but they are subject to staged rollout and subscription entitlement, so the tool reports the exact versions and channels instead of installing. All other listed distributions are identified and reported but never enter the installation path. See Supported Distributions for the current matrix.
Current version: v1.3.0. See CHANGELOG.md for changes.
| Item | Detail |
|---|---|
| Identifier | CVE-2026-98432 |
| Component | Linux kernel IPv4 subsystem (tcp_v4_syn_recv_sock, tcp_v4_reqsk_destructor) |
| Class | Use-after-free |
| Trigger | When retransmitted TCP SYNs are processed concurrently, or when request-socket migration is enabled via tcp_migrate_req, inet_opt and ireq_opt may be freed before the RCU grace period ends |
| Impact | Kernel memory corruption that can lead to denial of service. The exact impact and exploitation requirements are defined by each distribution's advisory |
| Upstream fix | ipv4: free inet_opt and ireq_opt after an RCU grace period, merged in 7.2.10, 6.18.56, 6.12.113, and 6.1.190 (commit 26d4c36d318c) |
| Published | 2026-10-15 |
Whether a distribution is affected and which version carries the fix are determined by that distribution's own advisory. The tool does not infer one distribution's status from another's, does not derive distribution fix status from the upstream version number, and does not assess CVSS scores or real-world exploitability.
ID, VERSION_ID, and VERSION_CODENAME from /etc/os-release and adds distribution-specific signals such as Oracle's UEK marker and Amazon Linux release numbers. ID_LIKE is not used to collapse identities: Ubuntu is never treated as Debian, and Rocky Linux, AlmaLinux, and Oracle Linux are never treated as RHEL.uname -m (x86_64 becomes amd64, aarch64 becomes arm64) and cross-checks the result against the architecture reported by the package manager. A mismatch produces UNKNOWN.--report writes a detection report with the supporting evidence; --list-distros prints the support matrix.kernel and the kernel-lts streams. Identification is available on Rocky Linux, AlmaLinux, Oracle Linux, Fedora, openSUSE Leap, SUSE Linux Enterprise, Arch Linux, and Alpine Linux. A distribution version outside an adapter's declared range returns UNSUPPORTED.--list-distros can be run as an unprivileged user.awk, sed, grep, tar, find, and the package manager tools for the target distribution (dpkg/apt-get/apt-cache, rpm/dnf/yum, apk, pacman, zypper). The bootstrap installer additionally requires curl and sha256sum (or shasum).curl -fsSL https://raw.githubusercontent.com/AronWang001/linux-cve-2026-98432-fix/v1.3.0/install.sh | sudo bash
install.sh is a bootstrap installer and makes no system changes itself. It downloads the source archive for the pinned tag into a temporary directory, fetches SHA256SUMS from the release, verifies fix.sh, install.sh, every file under lib/ and adapters/, and the baseline YAML under data/, and only then executes fix.sh with the same arguments. After detection it prints the planned change and installs the kernel only after you answer Y. The confirmation prompt reads from /dev/tty, so it still works when the installer is piped into bash; sudo may ask for a password.
Verification fails closed. A missing or empty SHA256SUMS, a manifest that does not cover every script, any hash mismatch, an absolute path or .. in the archive, or the absence of both sha256sum and shasum stops the run before any tool code executes. SHA256SUMS comes from the same repository as the archive and is not an independent signature; it must not be described as signature verification. Downloading and reviewing the script before production use is still recommended.
curl -fsSL https://raw.githubusercontent.com/AronWang001/linux-cve-2026-98432-fix/v1.3.0/install.sh | sudo bash -s -- --check
This reads system state only: no repository index refresh, no package installation, no configuration changes. --check governs the detection and remediation phases; it does not prevent install.sh from downloading the archive. If the local package index is empty, candidate versions will be reported as unknown, so run apt-get update or dnf makecache first.
curl -fsSL https://raw.githubusercontent.com/AronWang001/linux-cve-2026-98432-fix/v1.3.0/install.sh | sudo bash -s -- --yes
--yes skips the confirmation prompt only. It does not bypass the distribution allowlist, advisory verification, or version checks. Distributions outside the allowlist never enter the installation path, even with --yes.
curl -fsSLO https://raw.githubusercontent.com/AronWang001/linux-cve-2026-98432-fix/v1.3.0/install.sh
less install.sh
sudo bash install.sh --check
sudo bash install.sh
fix.sh depends on the lib/, adapters/, and data/ directories next to it and cannot be used on its own:
git clone --branch v1.3.0 --depth 1 https://github.com/AronWang001/linux-cve-2026-98432-fix.git
cd linux-cve-2026-98432-fix
sudo bash fix.sh --check
sudo bash fix.sh
SHA256SUMS covers fix.sh, install.sh, every script under lib/ and adapters/, and the baseline YAML under data/. Verify it against the source archive: