CVE-2026-98432 Mitigation

0x3639 · November 2, 2026, 9:51am

Pillar / Node operators on Ubuntu: stopgap for CVE-2026-98432 until the kernel fix ships

TL;DR: There is a critical Linux kernel bug (CVE-2026-98432) that lets a remote, unauthenticated attacker race TCP connection setup and potentially get code execution on the host. Ubuntu has not published fixed kernels yet. I put together a script that applies the Red Hat recommended mitigations, makes them survive reboots, and removes them cleanly later. znnd is not affected by any of the mitigations and does not need to be restarted.

Gist: CVE-2026-98432 stopgap mitigation for Ubuntu hosts running go-zenon (znnd): apply / verify / remove · GitHub

What the bug is

CVE-2026-98432 is a use-after-free in the kernel’s IPv4 TCP code. When a SYN carrying IP options is retransmitted while the kernel is finishing the handshake on another CPU, the IP options can be freed while still in use. Red Hat rates it Critical (CVSS 9.8) and says it can lead to remote code execution with no privileges or user interaction. Any host accepting inbound IPv4 TCP is in scope, and every pillar and sentinel listens publicly on the p2p port, so we are squarely in the exposed group.

References:

CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98432
Ubuntu status: CVE-2026-98432 | Ubuntu
Red Hat mitigation bulletin: RHSB-2026-016 Use-after-free - kernel IPv4 (CVE-2026-98432) | Red Hat Customer Portal

Ubuntu status (as of 2 Nov 2026)

Every maintained Ubuntu kernel is still listed as “Vulnerable, work in progress”:

Release	Fixed kernel in progress
24.04 noble	6.8.0-149
22.04 jammy	5.15.0-203
22.04 with HWE 6.8	6.8.0-149~22.04.1
20.04 focal	Vulnerable, no fix without Ubuntu Pro

If you are still on 20.04, this is a good reason to upgrade the host.

What the script does

sudo ./cve-2026-98432-mitigate.sh apply

Drops inbound IPv4 TCP packets that carry IP options using the exact nftables rule from the Red Hat bulletin. Normal TCP never uses IP options, so peers, wallets and RPC are unaffected. The rule lives in its own table so it coexists with ufw, iptables and Docker.
Disables Multipath TCP (net.mptcp.enabled=0). Ubuntu ships MPTCP on by default. znnd never opens MPTCP sockets (go-zenon’s go.mod pins go 1.20, which keeps Go’s MPTCP default off), so this costs nothing.
Disables TCP request socket migration (net.ipv4.tcp_migrate_req=0). This is already the Ubuntu default; the script just pins it.

Everything is persisted so it survives a reboot: the nft rule via a small oneshot systemd unit, the sysctls via a file in /etc/sysctl.d/. I deliberately did not enable nftables.service, because Ubuntu’s default config for it starts with a full ruleset flush that would wipe ufw/Docker rules at boot.

sudo ./cve-2026-98432-mitigate.sh verify is read-only and prints the kernel version, whether apt is offering a kernel upgrade, the nft rule with its drop counter, the two sysctls, any MPTCP listeners (should be none) and znnd’s listening sockets.

sudo ./cve-2026-98432-mitigate.sh remove undoes all of it.

Will znnd keep running?

Yes. I checked the go-zenon source: it sets no IP options, no MPTCP and no reuseport migration on any socket. The p2p port (35995), HTTP RPC (35997) and WebSocket RPC (35998) are plain TCP and are not touched. The script never restarts znnd.

How to use it

curl -fsSLO https://gist.githubusercontent.com/0x3639/283f3d9587cb84392d7170680258eb60/raw/cve-2026-98432-mitigate.sh
chmod +x cve-2026-98432-mitigate.sh
sudo ./cve-2026-98432-mitigate.sh verify
sudo ./cve-2026-98432-mitigate.sh apply

here is a one line version

curl -fsSLO https://gist.githubusercontent.com/0x3639/283f3d9587cb84392d7170680258eb60/raw/cve-2026-98432-mitigate.sh && chmod +x cve-2026-98432-mitigate.sh && sudo ./cve-2026-98432-mitigate.sh apply

Please read the script before running it; it is short and commented. Run it on one node first and watch your peer count for a few minutes before rolling it out to the rest.

Caveats

This is a stopgap, not a fix. Red Hat says the filter reduces exposure but “cannot fully prevent” exploitation. The real fix is the kernel update.
When the fixed kernel lands: sudo apt update && sudo apt upgrade, reboot, confirm uname -r shows a fixed version, then sudo ./cve-2026-98432-mitigate.sh remove.
The script has been syntax-checked and reviewed but I have not yet run it on a production node myself. If you hit a problem, post the output of verify here.

Happy to answer questions or take fixes in the thread.