CVE-2026-98432 - critical Linux kernel bug (CVSS 9.8)

Software PureOS
1

Derek Ross posted about it this X.com, copying the body text below.

Looks like PureOS Crimson is already patched.

  • :police_car_light: PSA for anyone running a Linux server, node, or relay

    CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.

    Ubuntu and Red Hat haven’t shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.

    What to do today:

    1. Check your kernel: uname -r
      Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you’re exposed.

    2. If your distro has a fix, update and reboot.

    3. If not, block the attack. It needs TCP packets with “IP options,” which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone’s probing you.

    4. Turn off MPTCP unless you need it:
      sysctl -w net.mptcp.enabled=0
      Programs built with Go 1.24+ use MPTCP automatically, and that’s how the known exploit gets in.

    5. Make it survive a reboot, and check it still works after one.

    If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.

    Self-hosting is freedom. Patching is part of the job. :shield:
    get root shell" risk.

2

Are any versions of 6.8.X affected or safe?

$ sudo sysctl -w net.mptcp.enabled=0
sysctl: cannot stat /proc/sys/net/mptcp/enabled: No such file or directory

What is best practice in above case, do you know?

Thanks again for you time

3

Linux 6.8 is unsupported since May 2024.

4

Hmm, thanks. I have a cloud provider that is either trolling or using a different versioning scheme.

5

I’d guess that you’re running an older Ubuntu LTS release where Canonical is supporting that kernel entirely on their own, so you need to check whether Ubuntu has fixed this in their kernel and in which version if so.

6

What about 6.18.0.1-librem5, is that one potentially fixed independently of the version numbers provided?

7

The version currently available in crimson, as seen in the package version and as reported by uname -a, is 6.18.56pureos1~cri1.