Te ngoikore o te kernel Linux CVE-2026-98432: Me pēhea te tirotiro me te whakahou i tō VPS

I te marama o Oketopa 2026, i kitea he ngoikoretanga nui, ko CVE-2026-98432 , i roto i te kernel Linux, he 9.8 i roto i te 10 te whakatauranga i runga i te tauine CVSS. Ka pā ki te whakahaere i ngā hononga IPv4 TCP e haere mai ana, ā, i raro i ētahi tikanga, ka taea e te kaiwhakaeke te uru pakiaka ki tētahi tūmau mamao - me te kore kupuhipa, me te kore mahi e hiahiatia ana mai i te kaiwhakahaere.

Kei raro nei ko wai ka pāngia, me pēhea te tirotiro i tō tūmau me pēhea te tiaki. Ka whakahaerehia ngā whakahau katoa hei pakiaka, hei sudo.

Te ngoikoretanga i te poto

• He aha te mea te reira: he pepeke kore-whakamahi-ā-muri-i roto i te waehere e whakatū ana i ngā hononga IPv4 TCP, i puta mai i tētahi āhuatanga whakataetae. Ka tukuna e te kaiwhakaeke ngā mōkihi kua hangaia motuhake ki tētahi tauranga TCP tuwhera.
• Ngā kākano e pāngia ana: ia putanga mai i te Linux 4.4, arā, tata ki ngā tohatoha o nāianei katoa.
• IPv6 kāore e pāngia e te pepeke matua.
• Te tino pono o te riri: I whakaaturia e ngā kairangahau tangata tētahi mekameka whakamahi kino e mahi ana i whiwhi urunga pakiaka i runga i tētahi tūmau me te Multipath TCP (MPTCP) kua whakahohea i roto i te 53 meneti. Kāore anō kia whakaputaina te waehere whakamahi kino.
• Ngā whakaekenga i te ngahere: I te 1 o Noema, 2026, kāore anō kia puta he pūrongo mō te whakamahi kino. He take tēnā hei whakahou mārire, ehara i te take hei whakaroa.

He mōrearea anō hoki kei ngā ratonga Go. Mai i te Go 1.24, ka whakarongo ngā kaupapa tūmau i runga i te Linux ki ngā tauranga mā te MPTCP i te wā e whakaaetia ana e te kernel. Tērā pea kāore te kaiwhakahaere e mōhio kei te whakaaetia e tā rātou tūmau aua hononga. I roto i ngā kaupapa rongonui, koinei te mahi a Xray — kua tukuna kētia e ngā kaiwhakawhanake he putanga ohorere, v26.10.31, e mono ana i te MPTCP i te taunoa.

Kei ia VPS tōna ake kernel, nō reira me whakahou e koe te kernel i roto i tō tūmau. Mā mātou anō e whakahou ngā pūnga mariko.

He whakatikatika mō tō pūnaha

Tūnga mai i te 1 o Noema, 2026. Tata tonu ki ia rā ka puta ngā whakatikatika — tirohia ngā hononga kei te mutunga o tēnei tuhinga mō te tūnga o nāianei.

Hipanga 1. Tirohia te kernel e whakahaerehia ana e koe

Kimihia te putanga o te kernel e rere ana:

uname -r

Kāore he kōrero a te tau putanga anake: ka whakatikahia ngā putanga tuara o ngā tohatoha ki roto i ō rātou ake kernel me te kore e whakarerekē i te putanga turanga. He pono ake te tirotiro i te rārangi huringa mōkihi kernel — ki te whakahuatia te tau CVE, kua tāutahia kētia te whakatikanga.

Debian me Ubuntu:

apt changelog linux-image-$(uname -r) 2>/dev/null | grep CVE-2026-98432

I runga i a Debian, ko te uname -v Ka whakaatuhia hoki e te whakahau te putanga katoa o te kernel e rere ana: whakatairitea ki te ripanga i runga ake nei.

AlmaLinux, Rocky Linux, RHEL, Oracle Linux:

rpm -q --changelog kernel-core-$(uname -r) | grep CVE-2026-98432

Ki te kore e tāia he mea e te whakahau, kei te ngoikore te kernel e rere ana.

Muri iho, tirohia ko ēhea ratonga e whakaae ana ki ngā hononga mā te MPTCP. Ko ngā tūmau pēnei i ēnei te whāinga i roto i te whakaekenga i whakaaturia:

ss -lnMp

Ko te tikanga o te putanga kau kāore he kaiwhakarongo MPTCP.

Hipanga 2. Tāutahia te kernel kua whakapumautia

Tangohia he tārua, he whakaahua rānei o tō tūmau i mua i te whakahōu i te kernel.

Debian 12 me te 13

Kei roto i te putunga haumarutanga ngā kernel kua whakaritea. Kia tino whakahohea:

grep -r security.debian.org /etc/apt/sources.list /etc/apt/sources.list.d/

Ki te kore he mea e kitea, tāpirihia security.debian.org putunga mō tō tukunga. Kātahi ka whakahou i te pūnaha:

apt update
apt full-upgrade
reboot

Ubuntu

Kāore anō kia tukuna ngā kernel kua whakatikatikaina. Tirohia mēnā he whakahōutanga:

apt update
apt list --upgradable | grep linux-image

Mena kei te hono tō tūmau ki te Ubuntu Pro, ka taea e koe te tirotiro i te mahere whakatika:

pro fix CVE-2026-98432 --dry-run

Kia tukuna te whakatikatika, tāutahia, ka whakaara anō:

apt update
apt full-upgrade
reboot

Kia tae rā anō ki taua wā, kia tino whakamahia te parenga rangitahi mai i te Hipanga 3.

AlmaLinux 8, 9, 10

Kei roto noa i te putunga whakamātautau ngā kernel kua whakaritea. Tāutahia mēnā e pai ana koe ki te mahi pēnā i runga i te tūmau whakaputa, ā, kia mahara ki te tango whakaahua i mua i te whakahōu:

dnf install -y almalinux-release-testing
dnf update 'kernel*' --enablerepo=almalinux-testing
dnf config-manager --disable almalinux-testing
reboot

I muri i te whakaara anō, whakatairitea uname -r me ngā putanga kei roto i te ripanga i runga ake nei. Ki te kore koe e pai ki te tāuta i ngā mōkihi whakamātautau, whakamahia te parenga rangitahi, ā, tatari kia tae atu te whakatika ki te putunga matua.

Rocky Linux me ētahi atu pūnaha e hangai ana ki te RHEL

Kāore anō kia kitea he whakatika. Ka taea e koe te tirotiro mā te whakamahi i:

dnf --refresh updateinfo info --all --cves CVE-2026-98432

Kia tukuna te whakatikatika:

dnf update kernel
reboot

I muri i te whakahōu: me whakaara anō

Ka whai mana te kernel hou i muri i te whakaara anō. Hei tirotiro mēnā e hiahiatia ana tētahi:

# Debian and Ubuntu
[ -f /var/run/reboot-required ] && echo "Reboot required"

# AlmaLinux, Rocky, RHEL
needs-restarting -r

Kia tīmata anō te rorohiko, me mahi anō te tirotiro mai i te Hipanga 1.

Hipanga 3. Tiakitanga rangitahi kia wātea rā anō he kernel pumau

Ka whakaitihia e ēnei mahi te mōrearea engari kāore e whakakapi i te whakahōunga kernel.

Āraia ngā mōkihi whakaoho

Ka whakamahia e te whakaeke ngā mōkihi TCP me ngā kōwhiringa IP i roto i te pane IPv4. Kāore rawa e puta mai i roto i te waka noa, ā, kua tūtohu kē te RFC 7126 kia whakatakahia. Ka whakatakahia e te ture nftables i raro nei ngā mōkihi IPv4 TCP katoa e haere mai ana me ngā kōwhiringa, ā, kāore e pā ki te IPv6, UDP, ICMP rānei. Ka mahi tahi me te ufw me te firewalld.

Tāutahia ngā nftables mēnā kāore anō kia tāutahia:

# Debian and Ubuntu
apt install -y nftables

# AlmaLinux, Rocky, RHEL
dnf install -y nftables

Waihangatia te kōnae ture:

cat > /etc/cve-2026-98432.nft <<'EOF'
table ip cve_2026_98432 {
    chain pre {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength gt 5 counter drop
    }
}
EOF

Hei whakahoki i te ture i muri i ia whakaara anō, waihangahia he ratonga pūnaha:

cat > /etc/systemd/system/cve-2026-98432.service <<'EOF'
[Unit]
Description=Mitigation for CVE-2026-98432
After=network-pre.target nftables.service firewalld.service ufw.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=-/usr/sbin/nft delete table ip cve_2026_98432
ExecStart=/usr/sbin/nft -f /etc/cve-2026-98432.nft
ExecStop=/usr/sbin/nft delete table ip cve_2026_98432

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now cve-2026-98432.service

Tirohia mēnā kua utaina te ture:

nft list table ip cve_2026_98432

Ki te tīmata anō koe i te ratonga nftables me te ao whānui flush ruleset whakahaere, whakahaere systemctl restart cve-2026-98432 muri iho.

He mea nui: kaua e whakamahia tēnei ture ki ngā whatunga e whakamahi ana i ngā tapanga CIPSO (SELinux, Smack NetLabel rānei) — ka whakamahia ngā kōwhiringa IP i reira. Mena ka tukuna e tō tūmau te waka mō ētahi atu mīhini, ka whakatakahia hoki e te ture ā rātou mōkihi TCP me ngā kōwhiringa IP.

Monokia te MPTCP mēnā kāore e hiahiatia ana

sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled = 0" > /etc/sysctl.d/99-disable-mptcp.conf

Ka ārai noa tēnei tautuhinga i te hou Kei hangaia ngā hononga MPTCP. Ka whakarongo tonu ngā ratonga kua rere kē mā MPTCP, nō reira tīmata anō i ngā ratonga katoa kua whakarārangihia e ss -lnMp ā, kia tino mohio kei te takoto kau tana putanga.

I runga i te AlmaLinux, ka monoa te MPTCP mā te taunoa mēnā kāore koe i whakahohe.

Monokia te MPTCP i roto i ngā kaupapa Go

Mō ngā ratonga i hangaia ki te Go 1.24, i muri mai rānei, ka taea e koe te whakakore i te MPTCP me te whakamahi i tētahi taurangi taiao. Hei tauira, mō tētahi ratonga e kiia nei ko myservice:

systemctl edit myservice

Tāpirihia ngā mea e whai ake nei ki te kōnae e tuwhera ana:

[Service]
Environment=GODEBUG=multipathtcp=0

Kātahi ka tīmata anō te ratonga:

systemctl restart myservice

Whakahōu i te X-ray

Ki te whakahaerehia e tō tūmau a Xray, whakahōu ki te putanga 26.10.31, ki muri rānei. Kua tangohia te putanga o mua, arā, te putanga 26.10.29, e ōna kaiwhakawhanake. Ka monoa e tēnei whakahōutanga te MPTCP engari kāore e whakatika i te kernel, nō reira me whakahōu tonu te kernel.

Tirohia tētahi atu tautuhinga

Me whakahohe te tono hekenga mō tētahi ara whakamahi whaiti tuarua. Kua whakawetohia i te taunoa — kia mōhio koe kei te wātea:

sysctl net.ipv4.tcp_migrate_req

Me tā te whakahau 0.

Whakawhāitihia te urunga ki ō ratonga

Katia ngā tauranga pareārai katoa kāore e hiahiatia kia taea te toro atu mā te ipurangi. Ki te taea, whakatuwheratia ngā ratonga whakahaere — SSH, ngā papatohu whakahaere, ngā pātengi raraunga — ki ngā wāhitau IP pono anake.

Hipanga 4. Whai muri i te tāutanga o te kernel kua whakatikatikaina

1. Tīmata anō i te tūmau, ka whakamahi i ngā whakahau mai i te Hipanga 1 hei whakaū kei te rere te kernel kua whakatikahia.
2. Ka taea e koe te tango i te ture rangitahi:
   

   systemctl disable --now cve-2026-98432.service
   rm /etc/systemd/system/cve-2026-98432.service /etc/cve-2026-98432.nft
   systemctl daemon-reload

   
   
3. Ki te hiahia koe ki te MPTCP, whakahokia te tautuhinga: muku /etc/sysctl.d/99-disable-mptcp.conf ka rere sysctl -w net.mptcp.enabled=1.

Ki te hē tetahi mea

Ki te kore tō tūmau e whakaara anō i muri i te whakahōutanga o te kernel, hono atu mā te papatohu VNC i te paewhiri mana, ka tīpako i te kernel o mua i te tahua whakaara. Ki te kore koe e tino mōhio ka taea e koe te mahi i tēnei, ki te hiahia āwhina rānei koe ki te whakahōu, whakapā atu ki tā mātou tīma tautoko.