cve-2026-98432-dkms

Ubuntu DKMS package for ipopt_guard, a kernel module that mitigates CVE-2026-98432 by dropping IPv4 TCP packets that carry IP options. It registers a netfilter hook in every network namespace, so it needs no firewall configuration and is unaffected by nft flush ruleset, firewalld or ufw.

This is a mitigation, not a fix. Remove the package once all supported kernels contain the upstream fix.

Build

make

The .deb is written to the parent directory.

Operation

The module is loaded on install and at boot by cve-2026-98432-dkms.service, and rebuilt by DKMS for new kernels when their headers are installed.

systemctl status cve-2026-98432-dkms              # failed = not protected
cat /sys/module/ipopt_guard/parameters/dropped    # packets dropped
journalctl -k --grep ipopt_guard                  # rate-limited drop log

Fixed kernels

DKMS skips kernels listed in kernel-is-fixed, and the service skips loading on them. Listed kernels run unprotected by this package, so only list a kernel once it is confirmed fixed. Anything not listed keeps the module.

Before each release, compare the table with https://ubuntu.com/security/CVE-2026-98432. Ubuntu 22.04, 24.04 and 26.04 are covered.

On Ubuntu 22.04, dkms autoinstall prints an error for skipped kernels. This is harmless, as DKMS 2.8.7 reports the exclusion the same way as a failure. A real build failure on 22.04 does not fail the kernel upgrade either, so rely on the service status to detect it.

Known limitations

• CIPSO sets ireq_opt itself, so sites using it are not protected. The module also drops their labeled TCP traffic. Turn dropping off with echo N > /sys/module/ipopt_guard/parameters/enabled, or persistently with options ipopt_guard enabled=N in /etc/modprobe.d/.
• Drops are silent to the sender: no TCP reset or ICMP error is returned.
• Secure Boot systems need the DKMS signing key enrolled, or the module will not load.