Raunin Ƙwayar Linux Kernel Mai Muhimmanci CVE-2026-98432: Yadda Ake Dubawa da Sabunta VPS ɗinka

A watan Oktoban 2026, an gano wani mummunan rauni, CVE-2026-98432 , a cikin ƙwayar Linux, wanda aka ƙididdige shi da maki 9.8 cikin 10 a sikelin CVSS. Yana shafar yadda ake sarrafa haɗin IPv4 TCP masu shigowa kuma, a ƙarƙashin wasu sharuɗɗa, yana ba wa mai hari damar samun damar shiga uwar garken daga nesa - ba tare da kalmar sirri ba kuma babu buƙatar wani aiki daga mai gudanarwa.

Ga wanda abin ya shafa, yadda ake duba sabar ku da kuma yadda ake kare ta. Duk umarni ana gudanar da su ne a matsayin tushen ko tare da su. sudo.

Rauni a takaice

• Abin da shi ne: wani kwaro da ba a amfani da shi bayan an yi amfani da shi ba a cikin lambar da ke saita haɗin IPv4 TCP, wanda yanayin tsere ya haifar. Mai kai harin yana aika fakiti na musamman da aka ƙera zuwa kowace tashar TCP da aka buɗe.
• Ƙwayoyin da abin ya shafa: kowace sigar tun daga Linux 4.4, wanda ke nufin kusan kowace rarrabawa ta yanzu.
• IPv6 babban kwaro ba ya shafarsa.
• Yadda wannan barazanar take da gaske: Masu binciken ɗan adam sun nuna wata sarkar amfani da ke aiki wacce ta sami damar shiga tushen sabar tare da Multipath TCP (MPTCP) a cikin kimanin mintuna 53. Ba a buga lambar amfani da ita ba.
• Hare-hare a daji: har zuwa ranar 1 ga Nuwamba, 2026, ba a bayar da rahoton wani cin zarafi ba. Wannan dalili ne na sabunta shi cikin natsuwa, ba dalili ba ne na jinkirta shi.

Ayyukan Go suna da haɗari daban. Tun daga Go 1.24, shirye-shiryen sabar akan Linux suna sauraron tashoshin jiragen ruwa ta hanyar MPTCP ta tsohuwa duk lokacin da kernel ya ba da damar hakan. Mai gudanarwa bazai ma san cewa sabar su tana karɓar irin waɗannan haɗin ba. Daga cikin shahararrun shirye-shiryen, Xray yana aiki ta wannan hanyar - masu haɓaka ta sun riga sun fitar da sigar gaggawa, v26.10.31, wanda ke kashe MPTCP ta tsohuwa.

Kowace VPS tana gudanar da nata kernel, don haka kuna buƙatar sabunta kernel a cikin sabar ku da kanku. Mu da kanmu muke sabunta virtualization nodes.

Akwai gyara ga tsarin ku

Matsayin da aka ɗauka a ranar 1 ga Nuwamba, 2026. Ana samun gyare-gyare kusan kowace rana - duba hanyoyin haɗin yanar gizo a ƙarshen wannan labarin don ganin halin da ake ciki a yanzu.

Mataki na 1. Duba wane kernel kake gudanarwa

Gano sigar kernel mai gudana:

uname -r

Lambar sigar kaɗai ba ta gaya maka komai ba: rarrabawa tana gyarawa zuwa cikin ƙwayoyin nasu ba tare da canza sigar tushe ba. Ya fi aminci a duba canjin kunshin kernel - idan ya ambaci lambar CVE, an riga an shigar da gyara.

Ubuntu da Debian:

apt changelog linux-image-$(uname -r) 2>/dev/null | grep CVE-2026-98432

A kan Debian, an gano uname -v umarnin kuma yana nuna cikakken sigar fakitin na kernel mai gudana: kwatanta shi da teburin da ke sama.

AlmaLinux, Rocky Linux, RHEL, Oracle Linux:

rpm -q --changelog kernel-core-$(uname -r) | grep CVE-2026-98432

Idan umarnin bai buga komai ba, ƙwayar da ke gudana tana da rauni.

Na gaba, duba waɗanne ayyuka ne ke karɓar haɗi ta hanyar MPTCP. Sabo irin waɗannan su ne aka yi niyya a harin da aka nuna:

ss -lnMp

Fitowar komai yana nufin babu masu sauraron MPTCP.

Mataki na 2. Shigar da kernel ɗin da aka gyara

Ɗauki madadin ko ɗaukar hoto na sabar ku kafin sabunta kernel.

Debian 12 da 13

Ƙwayoyin da aka gyara suna cikin ma'ajiyar tsaro. Tabbatar an kunna shi:

grep -r security.debian.org /etc/apt/sources.list /etc/apt/sources.list.d/

Idan babu wani abu da aka samu, ƙara security.debian.org ma'ajiyar bayanai don sakin ku. Sannan sabunta tsarin:

apt update
apt full-upgrade
reboot

Ubuntu

Ba a fitar da ƙwayoyin da aka gyara ba tukuna. Duba don sabuntawa:

apt update
apt list --upgradable | grep linux-image

Idan uwar garkenka yana haɗe da Ubuntu Pro, zaka iya duba tsarin gyara:

pro fix CVE-2026-98432 --dry-run

Da zarar an saki gyaran, shigar da shi kuma sake kunnawa:

apt update
apt full-upgrade
reboot

Har zuwa lokacin, tabbatar da amfani da kariyar wucin gadi daga Mataki na 3.

AlmaLinux 8, 9, da 10

Ana samun kernels da aka gyara a halin yanzu kawai a cikin ma'ajiyar gwaji. Shigar da su idan kuna jin daɗin yin hakan akan sabar samarwa, kuma tabbatar kun ɗauki hoto kafin sabuntawa:

dnf install -y almalinux-release-testing
dnf update 'kernel*' --enablerepo=almalinux-testing
dnf config-manager --disable almalinux-testing
reboot

Bayan sake kunnawa, kwatanta uname -r tare da nau'ikan da ke cikin teburin da ke sama. Idan ba kwa son shigar da fakitin gwaji, yi amfani da kariyar wucin gadi kuma jira gyara ya isa babban ma'ajiyar.

Rocky Linux da sauran tsarin da ke tushen RHEL

Babu wani gyara tukuna. Za ku iya kallon sa da:

dnf --refresh updateinfo info --all --cves CVE-2026-98432

Da zarar an fitar da gyara:

dnf update kernel
reboot

Bayan sabuntawa: ana buƙatar sake kunnawa

Sabuwar ƙwayar zare (currency) tana aiki ne kawai bayan sake kunnawa. Don duba ko ana buƙatar ɗaya:

# Debian and Ubuntu
[ -f /var/run/reboot-required ] && echo "Reboot required"

# AlmaLinux, Rocky, RHEL
needs-restarting -r

Bayan sake kunnawa, sake duba daga Mataki na 1.

Mataki na 3. Kariya ta wucin gadi har sai an sami kwaya mai ƙarfi

Waɗannan matakan suna rage haɗarin amma ba sa maye gurbin sabunta kernel.

Toshe fakitin jawowa

Harin yana amfani da fakitin TCP tare da zaɓuɓɓukan IP a cikin kanun IPv4. Kusan ba sa bayyana a cikin zirga-zirgar ababen hawa na yau da kullun, kuma RFC 7126 ya riga ya ba da shawarar a sauke su. Dokar nftables da ke ƙasa ta sauke duk fakitin TCP na IPv4 masu shigowa tare da zaɓuɓɓuka kuma ba ta shafar IPv6, UDP ko ICMP ba. Yana aiki tare da ufw da firewalld.

Shigar da nftables idan ba a riga an shigar da shi ba:

# Debian and Ubuntu
apt install -y nftables

# AlmaLinux, Rocky, RHEL
dnf install -y nftables

Ƙirƙiri fayil ɗin ƙa'ida:

cat > /etc/cve-2026-98432.nft <<'EOF'
table ip cve_2026_98432 {
    chain pre {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength gt 5 counter drop
    }
}
EOF

Domin a dawo da dokar bayan kowace sake kunnawa, ƙirƙiri sabis na systemd:

cat > /etc/systemd/system/cve-2026-98432.service <<'EOF'
[Unit]
Description=Mitigation for CVE-2026-98432
After=network-pre.target nftables.service firewalld.service ufw.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=-/usr/sbin/nft delete table ip cve_2026_98432
ExecStart=/usr/sbin/nft -f /etc/cve-2026-98432.nft
ExecStop=/usr/sbin/nft delete table ip cve_2026_98432

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now cve-2026-98432.service

Duba cewa an ɗora dokar:

nft list table ip cve_2026_98432

Idan ka sake kunna sabis na nftables tare da tsarin duniya flush ruleset mulki, gudu systemctl restart cve-2026-98432 bayan haka.

Muhimmi: kar a yi amfani da wannan doka a kan hanyoyin sadarwa da ke amfani da alamun CIPSO (SELinux ko Smack NetLabel) — Ana amfani da zaɓuɓɓukan IP a wurin. Idan sabar ku ta kai zirga-zirga ga wasu na'urori, dokar za ta kuma sauke fakitin TCP ɗinsu tare da zaɓuɓɓukan IP.

Kashe MPTCP idan ba kwa buƙatarsa

sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled = 0" > /etc/sysctl.d/99-disable-mptcp.conf

Wannan saitin yana hana kawai sabon Ba za a ƙirƙiri soket ɗin MPTCP ba. Ayyukan da suka riga suka fara aiki za su ci gaba da sauraro ta hanyar MPTCP, don haka sake kunna kowane sabis da aka jera ta hanyar MPTCP ss -lnMp kuma ka tabbatar da cewa fitowar sa ta zama babu komai yanzu.

A kan AlmaLinux, ana kashe MPTCP ta tsohuwa sai dai idan kun kunna shi da kanku.

Kashe shirye-shiryen MPTCP in Go

Ga ayyukan da aka gina tare da Go 1.24 ko sama da haka, zaku iya kashe MPTCP tare da canjin yanayi. Misali, ga sabis ɗin da ake kira myservice:

systemctl edit myservice

Ƙara abin da ke gaba zuwa fayil ɗin da ke buɗewa:

[Service]
Environment=GODEBUG=multipathtcp=0

Sannan sake kunna sabis ɗin:

systemctl restart myservice

Sabunta Xray

Idan sabar ku tana gudanar da Xray, ku sabunta ta zuwa v26.10.31 ko kuma daga baya. Masu haɓaka ta sun janye sigar da ta gabata, v26.10.29. Wannan sabuntawa yana kashe MPTCP amma ba ya gyara kernel, don haka har yanzu ana buƙatar sabunta kernel.

Duba wani saitin kuma

Hanya ta biyu mai kunkuntar amfani tana buƙatar buƙatar ƙaura ta kunna. An kashe ta hanyar tsoho - tabbatar da cewa:

sysctl net.ipv4.tcp_migrate_req

Umarnin ya kamata a buga 0.

Takaita damar shiga ayyukanka

Rufe kowace tashar wuta ta wuta wadda ba sai an same ta daga intanet ba. Inda zai yiwu, buɗe ayyukan gudanarwa — SSH, bangarorin sarrafawa, rumbun adana bayanai — kawai zuwa ga amintattun adiresoshin IP.

Mataki na 4. Bayan shigar da kernel ɗin da aka gyara

1. Sake kunna sabar kuma yi amfani da umarnin daga Mataki na 1 don tabbatar da cewa kernel ɗin da aka gyara yana aiki.
2. Za ka iya cire dokar wucin gadi:
   

   systemctl disable --now cve-2026-98432.service
   rm /etc/systemd/system/cve-2026-98432.service /etc/cve-2026-98432.nft
   systemctl daemon-reload

   
   
3. Idan kuna buƙatar MPTCP, dawo da saitin: share /etc/sysctl.d/99-disable-mptcp.conf da kuma gudu sysctl -w net.mptcp.enabled=1.

Idan wani abu yayi kuskure

Idan sabar ku ba ta fara aiki ba bayan sabunta kernel, haɗa ta hanyar na'urar VNC a cikin kwamitin sarrafawa kuma zaɓi kernel na baya a cikin menu na farawa. Idan ba ku da tabbacin za ku iya yin wannan da kanku, ko kuna buƙatar taimako tare da sabuntawa, tuntuɓi ƙungiyar tallafi.