Add interim mitigations for CVE-2026-98432 #691

2026-10-31T10:38:48Z

raucao commented

2026-10-31 10:38:48 +00:00

What

Interim mitigations for CVE-2026-98432 — a use-after-free in the Linux IPv4 TCP option handling (inet_opt/ireq_opt are freed with a plain kfree()), reachable by sending a TCP SYN carrying IP options. Ubuntu has not released a fixed kernel for any supported release yet.

Added to role[base]:

Drop inbound IPv4 TCP segments that carry IP options (no legitimate traffic uses them) and log the drops, rate limited, so probing is visible. The rules live in /etc/ufw/before.rules so they survive ufw reload.
Disable Multipath TCP where the kernel supports it (5.6+). Go programs built with Go ≥ 1.24 open MPTCP listeners by default (e.g. node_exporter), which is the precondition of the published exploit; nothing here needs MPTCP.

Also opts node_exporter out of MPTCP via GODEBUG=multipathtcp=0 and restarts it when the unit changes.

Hosts on older kernels (5.4, no MPTCP) skip the sysctl and only get the packet filter.

Why not the core `sysctl` resource

Its reload runs sysctl -p against /etc/sysctl.conf, which no longer exists on Ubuntu 26.04 — the resource failed there. The drop-in is written directly instead.

Verification

Converged and verified on all internet-facing hosts (draco, fornax, leo) and every node that exposed an MPTCP listener (garage-11/14/15, strfry-1, postgres-11, redis-3/4):

rules active at the top of ufw-before-input, ufw active
net.mptcp.enabled=0 + drop-in on ≥ 5.6 kernels
MPTCP listeners 1 → 0
functional check: a plain TCP connect succeeds, while the same connect with IP_OPTIONS set is dropped (counter increments, kernel log line emitted)

Follow-up

The rest of the fleet picks this up on its next normal converge.
her (KVM host) was unreachable and still needs it.
The real remediation remains a patched kernel: ESM on the 20.04 hosts, reboot into the fix when Ubuntu ships it.

## What Interim mitigations for **CVE-2026-98432** — a use-after-free in the Linux IPv4 TCP option handling (`inet_opt`/`ireq_opt` are freed with a plain `kfree()`), reachable by sending a TCP SYN carrying IP options. Ubuntu has not released a fixed kernel for any supported release yet. Added to `role[base]`: * **Drop inbound IPv4 TCP segments that carry IP options** (no legitimate traffic uses them) and log the drops, rate limited, so probing is visible. The rules live in `/etc/ufw/before.rules` so they survive `ufw reload`. * **Disable Multipath TCP** where the kernel supports it (5.6+). Go programs built with Go ≥ 1.24 open MPTCP listeners by default (e.g. `node_exporter`), which is the precondition of the published exploit; nothing here needs MPTCP. Also opts `node_exporter` out of MPTCP via `GODEBUG=multipathtcp=0` and restarts it when the unit changes. Hosts on older kernels (5.4, no MPTCP) skip the sysctl and only get the packet filter. ## Why not the core `sysctl` resource Its reload runs `sysctl -p` against `/etc/sysctl.conf`, which no longer exists on Ubuntu 26.04 — the resource failed there. The drop-in is written directly instead. ## Verification Converged and verified on all internet-facing hosts (`draco`, `fornax`, `leo`) and every node that exposed an MPTCP listener (`garage-11/14/15`, `strfry-1`, `postgres-11`, `redis-3/4`): * rules active at the top of `ufw-before-input`, `ufw` active * `net.mptcp.enabled=0` + drop-in on ≥ 5.6 kernels * MPTCP listeners `1 → 0` * functional check: a plain TCP connect succeeds, while the same connect with `IP_OPTIONS` set is dropped (counter increments, kernel log line emitted) ## Follow-up * The rest of the fleet picks this up on its next normal converge. * `her` (KVM host) was unreachable and still needs it. * The real remediation remains a patched kernel: ESM on the 20.04 hosts, reboot into the fix when Ubuntu ships it.

😕 1

raucao added 2 commits 2026-10-31 10:38:48 +00:00

Add interim mitigations for CVE-2026-98432 b299910dc6

CVE-2026-98432 is a use-after-free in the Linux IPv4 TCP option
handling (inet_opt/ireq_opt are freed with a plain kfree()) that is
reachable by sending a TCP SYN carrying IP options. No fixed kernel has
been released for any supported Ubuntu release yet, so mitigate in
role[base] until one is:

* Drop inbound IPv4 TCP segments that carry IP options (no legitimate
  traffic uses them) and log the drops, rate limited, so probing is
  visible. The rules are added to /etc/ufw/before.rules so they survive
  ufw reloads, and are idempotent.

* Disable Multipath TCP where the kernel supports it (5.6+). Go
  programs built with Go >= 1.24 open MPTCP listeners by default, which
  is the precondition of the published exploit; nothing here needs
  MPTCP. Hosts on older kernels (5.4, no MPTCP) skip this.

The sysctl drop-in is written directly rather than via the core sysctl
resource, whose reload runs `sysctl -p` against /etc/sysctl.conf - a
file that no longer exists on Ubuntu 26.04.

Opt node_exporter (Go >= 1.24, so it opened an MPTCP listener) out of
MPTCP with GODEBUG=multipathtcp=0, and restart it when the unit
changes so the change takes effect without a separate restart.

Update nodes 1e018ac6b4

Pick up the refreshed node objects from the CVE-2026-98432 converge.

raucao added the kredits-2 ops security labels 2026-10-31 10:39:38 +00:00

raucao requested review from greg 2026-10-31 10:39:45 +00:00

greg approved these changes

2026-10-31 10:48:53 +00:00

greg left a comment

👍

greg merged commit 8904bb2e67 into master

2026-10-31 10:49:14 +00:00

greg deleted branch chore/mptcp

2026-10-31 10:49:14 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/chef#691

Add interim mitigations for CVE-2026-98432 #691

What

Why not the core sysctl resource

Verification

Follow-up

Why not the core `sysctl` resource