Patched Ubuntu kernel for CVE-2026-98432

build-patched-kernel.sh builds Ubuntu kernel .deb packages that include the upstream fix for CVE-2026-98432:

e3f33b0a1d89 "ipv4: free inet_opt and ireq_opt after an RCU grace period"

The bug is a use-after-free in ip_options_build(). One CPU can still be sending a SYNACK while another frees the IPv4 options of a TCP socket. The fix replaces two kfree() calls with kfree_rcu(), in net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c.

What the script does

1. Takes the kernel version from the first argument, or from uname -r if none is given (e.g. 6.8.0-45-generic).
2. Enables deb-src repositories and installs the compiler and build tools.
3. Downloads the Ubuntu source package that built this kernel with apt-get source. If the archive no longer has that version, it falls back to pull-lp-source from Launchpad. It then installs the build dependencies.
4. Applies the fix. It replaces the two lines directly instead of applying the upstream diff, because the surrounding code differs between Ubuntu kernels. On kernels older than 5.7, where kfree_rcu() doesn't accept NULL, it adds a NULL check.
5. Appends +cve202698432.1 to the package version, so the new packages upgrade the archive packages with the same ABI.
6. Builds with Ubuntu's debian/rules and copies the .deb files to ./debs-<version>/.

Running the script again reuses the downloaded sources and doesn't patch them twice.

Usage

On the Ubuntu machine itself (run as root or with sudo):

./build-patched-kernel.sh                    # kernel from uname -r
./build-patched-kernel.sh 6.8.0-45-generic   # a specific kernel

In Docker, use the Ubuntu release that matches the kernel (noble for 6.8, jammy for 5.15). Pass the version explicitly, because uname -r inside a container shows the host's kernel:

docker run --rm -v "$PWD":/work -w /work -e WORKDIR=/build ubuntu:24.04 \
    ./build-patched-kernel.sh 6.8.0-45-generic

WORKDIR=/build keeps the kernel sources inside the container. You need this when the mounted directory is case-insensitive, as on macOS. Other settings (OUTDIR, LOCAL_SUFFIX, SRC_PACKAGE/SRC_VERSION, JOBS) are described at the top of the script.

Installing

sudo apt install ./debs-<version>/linux-image-unsigned-<version>_*.deb \
                 ./debs-<version>/linux-modules-<version>_*.deb \
                 ./debs-<version>/linux-modules-extra-<version>_*.deb \
                 ./debs-<version>/linux-headers-*.deb
sudo reboot

The kernel image is unsigned and replaces the signed linux-image-<version> package. If Secure Boot is on, either sign the image with your own MOK key or turn Secure Boot off.