raucao
b299910dc6
CVE-2026-98432 is a use-after-free in the Linux IPv4 TCP option handling (inet_opt/ireq_opt are freed with a plain kfree()) that is reachable by sending a TCP SYN carrying IP options. No fixed kernel has been released for any supported Ubuntu release yet, so mitigate in role[base] until one is: * Drop inbound IPv4 TCP segments that carry IP options (no legitimate traffic uses them) and log the drops, rate limited, so probing is visible. The rules are added to /etc/ufw/before.rules so they survive ufw reloads, and are idempotent. * Disable Multipath TCP where the kernel supports it (5.6+). Go programs built with Go >= 1.24 open MPTCP listeners by default, which is the precondition of the published exploit; nothing here needs MPTCP. Hosts on older kernels (5.4, no MPTCP) skip this. The sysctl drop-in is written directly rather than via the core sysctl resource, whose reload runs `sysctl -p` against /etc/sysctl.conf - a file that no longer exists on Ubuntu 26.04. Opt node_exporter (Go >= 1.24, so it opened an MPTCP listener) out of MPTCP with GODEBUG=multipathtcp=0, and restart it when the unit changes so the change takes effect without a separate restart.
kosmos_prometheus
TODO: Enter the cookbook description here.