Month: November 2026

Posted on
by

There is a severe TCP Use-After-Free: CVE-2026-98432 without proper mitigation via stock Linux Kernels from Ubuntu. However Ubuntu has published an advisory. Here is a script that applies temporary mitigation on Ubuntu

This script is based on the advisory : https://web.archive.org/web/20261103091553/https://ubuntu.com/security/CVE-2026-98432

How to run:

bash cve-2026-98432-mitigation.sh apply

The script:

#!/usr/bin/env bash
#
# Mitigation for CVE-2026-98432 (Linux kernel IPv4 TCP ireq_opt use-after-free).
# Drops inbound IPv4 TCP packets that carry IP options, using a private
# nftables table. This REDUCES risk; it is not a fix. Install the patched
# kernel as soon as it is available and reboot.
#
# Usage: sudo ./cve-2026-98432-mitigation.sh {apply|unapply|status}
#
# Env: WITH_FORWARD=1 also drop such packets on the forward hook (protects
# containers/VMs behind this host; breaks IP options
# on transit traffic if this host is a router).
#
# Persistence uses a dedicated systemd unit that loads ONLY our own table,
# so /etc/nftables.conf (and its "flush ruleset") is never touched and other
# firewalls (ufw, firewalld, Docker, libvirt) are not disturbed.
set -euo pipefail
umask 022
CVE="cve-2026-98432"
TABLE="cve_2026_98432"
RULE_FILE="/etc/${CVE}.nft"
UNIT_NAME="${CVE}-mitigation.service"
UNIT_FILE="/etc/systemd/system/${UNIT_NAME}"
NFT_CONF="/etc/nftables.conf"
LEGACY_INCLUDE="include \"${RULE_FILE}\""
WITH_FORWARD="${WITH_FORWARD:-0}"
die() { echo "Error: $*" >&2; exit 1; }
warn() { echo "Warning: $*" >&2; }
[ "${EUID}" -eq 0 ] || die "run as root (use sudo)."
NFT_BIN="$(command -v nft || true)"
[ -n "${NFT_BIN}" ] || die "nftables (nft) is not installed or not in PATH."
TMP_FILES=()
cleanup() { [ "${#TMP_FILES[@]}" -gt 0 ] && rm -f "${TMP_FILES[@]}"; return 0; }
trap cleanup EXIT
# Sets $TMP (no command substitution, so TMP_FILES is updated in this shell).
TMP=""
mktmp() { TMP="$(mktemp)"; TMP_FILES+=("${TMP}"); }
have_systemd() { command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; }
# Single-instance lock
exec 9>"/run/${CVE}-mitigation.lock"
flock -n 9 || die "another instance is already running."
render_rules() {
# add+delete makes the file idempotent: re-loading replaces the table
# instead of appending a duplicate rule.
cat <<EOF
add table inet ${TABLE}
delete table inet ${TABLE}
table inet ${TABLE} {
chain input {
type filter hook input priority -310; policy accept;
ip protocol tcp ip hdrlength > 5 counter drop
}
EOF
if [ "${WITH_FORWARD}" = "1" ]; then
cat <<EOF
chain forward {
type filter hook forward priority -310; policy accept;
ip protocol tcp ip hdrlength > 5 counter drop
}
EOF
fi
echo "}"
}
render_unit() {
cat <<EOF
[Unit]
Description=CVE-2026-98432 mitigation (drop IPv4 TCP packets with IP options)
DefaultDependencies=no
After=local-fs.target nftables.service
PartOf=nftables.service
Wants=network-pre.target
Before=network-pre.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=${NFT_BIN} -f ${RULE_FILE}
ExecStop=-${NFT_BIN} delete table inet ${TABLE}
[Install]
WantedBy=multi-user.target
EOF
}
table_loaded() { "${NFT_BIN}" list table inet "${TABLE}" >/dev/null 2>&1; }
apply_mitigation() {
echo "Applying ${CVE} mitigation..."
# 1. Render to a temp file and validate BEFORE touching anything on disk.
local tmp; mktmp; tmp="${TMP}"
render_rules > "${tmp}"
"${NFT_BIN}" -c -f "${tmp}" || die "rule validation failed; nothing changed."
# 2. Install atomically (no clobber of a good file with a bad one).
install -m 0644 -o root -g root "${tmp}" "${RULE_FILE}"
echo "Installed ${RULE_FILE}"
# 3. Load into the live ruleset (idempotent).
"${NFT_BIN}" -f "${RULE_FILE}"
table_loaded || die "table ${TABLE} not present after load."
echo "Live rule loaded."
# 4. Boot persistence via our own unit.
if have_systemd; then
local utmp; mktmp; utmp="${TMP}"
render_unit > "${utmp}"
install -m 0644 -o root -g root "${utmp}" "${UNIT_FILE}"
systemctl daemon-reload
systemctl enable "${UNIT_NAME}" >/dev/null \
|| die "live rule is active, but enabling ${UNIT_NAME} failed (no persistence)."
echo "Persistence enabled (${UNIT_NAME})."
else
warn "systemd not detected: rule is live but will NOT survive a reboot."
fi
if grep -Fxq "${LEGACY_INCLUDE}" "${NFT_CONF}" 2>/dev/null; then
echo "Note: legacy include found in ${NFT_CONF}; harmless (rule file is idempotent)."
fi
warn "this is a partial mitigation. Install the kernel fix when released: uname -r = $(uname -r)"
[ "${WITH_FORWARD}" = "1" ] || \
echo "Note: forwarded traffic (containers/VMs behind this host) is NOT covered; use WITH_FORWARD=1 if needed."
echo "Mitigation applied."
}
unapply_mitigation() {
echo "Removing ${CVE} mitigation..."
if have_systemd && [ -f "${UNIT_FILE}" ]; then
systemctl disable --now "${UNIT_NAME}" >/dev/null 2>&1 || true
rm -f "${UNIT_FILE}"
systemctl daemon-reload
echo "Removed ${UNIT_NAME}."
fi
if table_loaded; then
"${NFT_BIN}" delete table inet "${TABLE}"
echo "Removed live table inet ${TABLE}."
else
echo "Live table not present."
fi
# Clean up a legacy include from the vendor/old-script method, if present.
if [ -f "${NFT_CONF}" ] && grep -Fxq "${LEGACY_INCLUDE}" "${NFT_CONF}"; then
local bak t
bak="${NFT_CONF}.bak.$(date +%Y%m%d%H%M%S)"
mktmp; t="${TMP}"
cp -p "${NFT_CONF}" "${bak}"
grep -Fxv "${LEGACY_INCLUDE}" "${NFT_CONF}" > "${t}" || true
cat "${t}" > "${NFT_CONF}" # preserves mode/owner/symlink
echo "Removed legacy include from ${NFT_CONF} (backup: ${bak})."
fi
rm -f "${RULE_FILE}"
echo "Mitigation removed."
}
status() {
echo "Kernel: $(uname -r)"
if table_loaded; then
"${NFT_BIN}" list table inet "${TABLE}"
else
echo "Table inet ${TABLE}: NOT loaded"
fi
if have_systemd; then
echo "Boot persistence: $(systemctl is-enabled "${UNIT_NAME}" 2>/dev/null || echo not-enabled)"
fi
}
case "${1:-}" in
apply) apply_mitigation ;;
unapply) unapply_mitigation ;;
status) status ;;
*) echo "Usage: $0 {apply|unapply|status}" >&2; exit 1 ;;
esac
view raw cve-2026-98432-mitigation.sh hosted with ❤ by GitHub