igreklg/cve-2026-98432-mitigationAudits Debian/Ubuntu kernels for CVE-2026-98432 and applies persistent nftables and sysctl mitigations, then guides kernel upgrade and rollback.
The script checks whether the kernel is patched against CVE-2026-98432 (use-after-free in IPv4 TCP handling, CVSS 9.8). If the kernel is not patched, it immediately enables a temporary mitigation and helps install the kernel update.
The mitigation reduces risk but does not eliminate the vulnerability. There is only one complete solution: install the patched kernel and reboot. According to Red Hat's assessment, packet filtering with IP options does not fully rule out exploitation.
tcp_v4_syn_recv_sock() passes ireq_opt to the child socket without copying it, and inet_sock_destruct() frees it with a regular kfree(). A repeated SYN, which is being processed at that moment on another CPU core, accesses already freed memory in ip_options_build().net.ipv4.tcp_migrate_req=1 or the BPF program BPF_SK_REUSEPORT_SELECT_OR_MIGRATE.ipv4: free inet_opt and ireq_opt after an RCU grace period (e3f33b0a1d89).| Stable branch | Fixed in |
|---|---|
| 5.10 | 5.10.272 |
| 5.15 | 5.15.223 |
| 6.1 | 6.1.190 |
| 6.6 | 6.6.159 |
| 6.12 | 6.12.113 |
| 6.18 | 6.18.56 |
| 7.2 | 7.2.10 |
| mainline | 7.3 |
Status in distributions as of November 2, 2026:
linux 6.1.190-1 (DLA-4841-1) and linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1).linux 6.12.113-1 (DSA-6568-1).prerouting hook with raw priority (−300), that is, before the kernel parses the options. Uses nftables, or if it is unavailable, iptables with the u32 module.net.mptcp.enabled = 0. Already open MPTCP sockets remain MPTCP, so the script lists them so you can restart those services.net.ipv4.tcp_migrate_req = 0 if the value was 1.nftables / netfilter-persistent / firewalld restart, and a check via timer every 5 minutes.If the running kernel is already fixed, the script changes nothing and suggests how to remove previously enabled protection.
nftables (recommended) or iptables. Persistent protection requires systemd.git clone https://github.com/IgrekLg/cve-2026-98432-mitigation.git
cd cve-2026-98432-mitigation
sudo bash mitigate-cve-2026-98432.sh # аудит, защита, предложение обновить ядро
sudo bash mitigate-cve-2026-98432.sh --status # только посмотреть, ничего не меняя
| Key | Action |
|---|---|
--status | Show status only |
--uninstall | Remove protection and restore the original sysctl values (if the kernel is not patched, it will ask for confirmation) |
-y, --yes | No questions asked: install the kernel update, confirm --uninstall |
--no-upgrade | Do not contact apt: audit and protect only |
--force | Enable protection even if the kernel is already patched |
--keep-mptcp | Do not disable MPTCP |
--keep-tcp-migrate | Do not touch net.ipv4.tcp_migrate_req |
If there is no terminal (Ansible, cron, ssh without -t) and --yes is not specified, protection is still enabled, and the kernel installation is skipped with a hint.
| Code | Meaning |
|---|---|
| 0 | The running kernel is patched or unaffected |
| 3 | The kernel is not patched, protection is active: an update and reboot are required |
| 4 | The kernel is not patched, protection is not active |
| 1 | Error |
| 2 | Invalid arguments |
Example for Ansible:
- name: CVE-2026-98432 mitigation
ansible.builtin.script: mitigate-cve-2026-98432.sh --yes
register: cve
failed_when: cve.rc not in [0, 3]
changed_when: false
Checks are performed in order:
CVE-2026-98432 or the title of the fixing commit, the kernel is patched.6.1.190-1. The upstream part of the version is compared against the table above. Debian receives fixes through stable updates, and the CVE number is not always specified in the changelog.5.15.0-NNN) does not reflect the stable branch, so the kernel is considered patched only based on the changelog. Without it, the status is "fix not confirmed", and the protection is enabled. Additionally, pro fix CVE-2026-98432 --dry-run is output.uname -r is compared. Release-candidate kernels (-rc) are considered unknown.The table of fixed versions is hardcoded into the script (FIXED_IN, data as of 2026-11-02). For derivative distributions with their own kernels (Proxmox, etc.), consult the vendor's bulletin.
| Path | Purpose |
|---|---|
/usr/local/sbin/cve-2026-98432-fw | Helper: apply / ensure / remove / check |
/etc/cve-2026-98432/mitigation.nft | nftables rule (table ip cve_2026_98432) |
/etc/systemd/system/cve-2026-98432-mitigation.service | Applies the rule at boot, before network-pre.target |
/etc/systemd/system/cve-2026-98432-mitigation-check.{service,timer} | Check every 5 minutes, restores the rule if someone removed it (logs to syslog) |
/etc/systemd/system/{nftables,netfilter-persistent,firewalld}.service.d/50-cve-2026-98432.conf | Re-applies after (re)loading of rules by these services; created only for installed ones |
/etc/sysctl.d/99-zz-cve-2026-98432.conf | sysctl; the name is chosen so that the file is read after /etc/sysctl.conf |
/var/lib/cve-2026-98432/sysctl.orig | Original sysctl values for --uninstall |
Files from the previous version of the script (mitigate-CVE-2026-98432.service, 99-CVE-2026-98432.conf and duplicate iptables rules) are removed automatically.