Dear Users of the de.NBI Cloud Tübingen,
We would like to inform you about a critical Linux kernel vulnerability, CVE-2026-98432, affecting the IPv4 TCP stack. The vulnerability may allow remote attackers to cause kernel crashes, memory corruption, or potentially execute arbitrary code. Systems using Multipath TCP (MPTCP) listeners may be particularly exposed.
Recommended actions:
- Check your running kernel version using uname -r.
- Check for active MPTCP listeners using sudo ss -lnMp.
- Install the latest security updates provided by your Linux distribution and reboot your systems.
For further information, please consult the relevant security advisories:
- Debian Security Tracker https://security-tracker.debian.org/tracker/CVE-2026-98432
- Ubuntu Security Tracker https://ubuntu.com/security/CVE-2026-98432
- AlmaLinux Security Announcement https://almalinux.org/blog/2026-10-30-cve-2026-98432/
Temporary mitigation (if immediate patching is not possible):
Two additional measures can help mitigate the vulnerability, If immediate patching is not possible:
- Disable MPTCP:
sudo sysctl -w net.mptcp.enabled=0
- Block incoming IPv4 TCP packets containing IP options using nftables:
sudo nft add table ip cve_2026_98432 && \
sudo nft add chain ip cve_2026_98432 pre \
'{ type filter hook prerouting priority -300; }' && \
sudo nft add rule ip cve_2026_98432 pre \
meta l4proto tcp ip hdrlength gt 5 counter drop
We strongly encourage all users to check their systems and apply the necessary security updates or temporary mitigations as soon as possible.
Best regards,
Amir Baleghi
On behalf of the de.NBI Cloud Tübingen Team,