Critical Linux Kernel Vulnerability CVE-2026-98432: Maitiro ekutarisa nekuvandudza VPS yako

Muna Gumiguru 2026, dambudziko guru, CVE-2026-98432 , rakawanikwa muLinux kernel, rakaongororwa pa9.8 kubva pa10 pachikero cheCVSS. Rinokanganisa mabatirwo anoitwa IPv4 TCP connections uye, pasi pemamwe mamiriro ezvinhu, rinobvumira murwisi kuwana root access kune server ari kure — pasina password uye pasina chiito chinodiwa kubva kumukuru.

Pazasi pane kuti ndiani ari kukanganiswa, maitiro ekutarisa sevha yako uye maitiro ekuidzivirira. Mirairo yese inomhanya semudzi kana ne sudo.

Kushaya simba muchidimbu

• Chii chiri: bug isina kushandiswa mushure mekushandisa mukodhi inogadzirisa IPv4 TCP connections, inokonzerwa nemamiriro emujaho. Murwisi anotumira mapaketi akagadzirwa zvakananga kune chero chiteshi cheTCP chakavhurika.
• Mbeu dzakakanganiswa: shanduro dzese kubva paLinux 4.4, zvinoreva kuti zvese zvinogoverwa zviripo.
• IPv6 haina kukanganiswa nekanganiso huru.
• Kuti njodzi iyi ndeyechokwadi sei: Vaongorori veruzivo rwevanhu vakaratidza kuti nzira yekushandiswa kwedata yakawana mukana wekuwana root access paserver neMultipath TCP (MPTCP) inobatidzwa mumaminitsi angangoita makumi mashanu nematatu. Kodhi yekushandiswa kwedata haisati yaburitswa.
• Kurwiswa musango: Kubva musi wa1 Mbudzi, 2026, hapana kushungurudzwa kwakaitwa. Ndiyo chikonzero chekuvandudza zvinhu zvinyoro nyoro, kwete chikonzero chekunonoka.

Masevhisi eGo ane njodzi yakasiyana. Kubva paGo 1.24, mapurogiramu eseva paLinux anoteerera pamaports kuburikidza neMPTCP pese painobvumira kernel. Administrator angasatomboziva kuti server yavo inogamuchira kubatana kwakadaro. Pakati pemapurogiramu anozivikanwa, Xray inoshanda seizvi - vagadziri vayo vakatoburitsa emergency version, v26.10.31, iyo inodzima MPTCP nedefault.

VPS yega yega ine kernel yayo, saka unofanirwa kugadzirisa kernel iri mukati meserver yako wega. Isu tinogadzirisa ma node e virtualization isu pachedu.

Pane here kugadzirisa system yako?

Mamiriro ezvinhu kubva musi wa1 Mbudzi, 2026. Kugadziriswa kuri kuitika zuva nezuva — tarisa malink ari kumagumo kwechinyorwa chino kuti uone mamiriro aripo iye zvino.

Nhanho 1. Tarisa kuti uri kushandisa kernel ipi

Tsvaga vhezheni yekernel iri kumhanya:

uname -r

Nhamba yeshanduro yega haina chainokuudza: distributions backport inogadzirisa ma kernels ayo pasina kuchinja base version. Zviri nyore kutarisa kernel package changelog — kana ikataura nezve CVE number, kugadzirisa kwacho kwatoiswa.

Debian na Ubuntu:

apt changelog linux-image-$(uname -r) 2>/dev/null | grep CVE-2026-98432

PaDebian, iyo uname -v murairo unoratidzawo vhezheni yakazara yepakeji yekernel iri kumhanya: enzanisa netafura iri pamusoro.

AlmaLinux, Rocky Linux, RHEL, Oracle Linux:

rpm -q --changelog kernel-core-$(uname -r) | grep CVE-2026-98432

Kana murairo usingadhindi chinhu, kernel iri kumhanya inenge iri panjodzi.

Tevere, tarisa kuti ndeapi masevhisi anogamuchira kubatana kuburikidza neMPTCP. Masevha akadai ndiwo akange ari chinangwa mukurwiswa kwakaratidzwa:

ss -lnMp

Kubuda kusina chinhu kunoreva kuti hapana vateereri veMPTCP.

Danho rechipiri. Isa kernel yakagadziriswa

Tora backup kana snapshot yeserver yako usati wagadzirisa kernel.

Debian 12 na13

Makenduru akagadziriswa ari mudura rekuchengetedza. Ita shuwa kuti agoneswa:

grep -r security.debian.org /etc/apt/sources.list /etc/apt/sources.list.d/

Kana pasina chawanikwa, wedzera security.debian.org nzvimbo yekuchengetera zvinhu zvako. Wobva wagadzirisa sisitimu yacho:

apt update
apt full-upgrade
reboot

Ubuntu

Makenduru akagadziriswa haasati aburitswa. Tarisa kuti uwane zvichangobva kuitika here:

apt update
apt list --upgradable | grep linux-image

Kana sevha yako yakabatana neUbuntu Pro, unogona kutarisa hurongwa hwekugadzirisa:

pro fix CVE-2026-98432 --dry-run

Kana gadziriso yaburitswa, isa wotangazve:

apt update
apt full-upgrade
reboot

Kusvika panguva iyoyo, iva nechokwadi chekushandisa dziviriro yechinguvana kubva kuDanho rechitatu.

AlmaLinux 8, 9, 10

Makerubhi akagadziriswa aripo chete mu testing repository. Isa kana uchida kuzviita pa production server, uye iva nechokwadi chekutora snapshot usati wagadzirisa:

dnf install -y almalinux-release-testing
dnf update 'kernel*' --enablerepo=almalinux-testing
dnf config-manager --disable almalinux-testing
reboot

Mushure mekutangazve, enzanisa uname -r neshanduro dziri patafura iri pamusoro. Kana usingade kuisa mapakeji ekuyedza, shandisa dziviriro yenguva pfupi womirira kuti kugadzirisa kusvike panzvimbo huru yekuchengetedza.

Rocky Linux nedzimwe nzira dzeRHEL

Hapana mhinduro iripo parizvino. Unogona kuitarisa uchishandisa:

dnf --refresh updateinfo info --all --cves CVE-2026-98432

Kana kugadzirisa kwangoburitswa:

dnf update kernel
reboot

Mushure mekuvandudza: kutangazve kunodiwa

Kernel itsva inotanga kushanda chete mushure mekudzokorodza. Kuti uone kana ichidiwa:

# Debian and Ubuntu
[ -f /var/run/reboot-required ] && echo "Reboot required"

# AlmaLinux, Rocky, RHEL
needs-restarting -r

Mushure mekutangazve, dzokorora cheki kubva paDanho 1.

Danho rechitatu. Dziviriro yenguva pfupi kusvika kernel yakagadziriswa yawanikwa

Matanho aya anoderedza njodzi asi haatsivi kernel update.

Vhara mapaketi etrigger

Kurwiswa uku kunoshandisa mapaketi eTCP ane maIP options muIPv4 header. Haamboonekwi mutraffic yakajairika, uye RFC 7126 yatokurudzira kuti adziswe. Mutemo wenftables uri pazasi unobvisa mapaketi ese eIPv4 TCP ari kuuya ane maoptions uye haukanganisi IPv6, UDP kana ICMP. Inoshanda pamwe chete neufw nefirewalld.

Isa nftables kana isati yatoiswa:

# Debian and Ubuntu
apt install -y nftables

# AlmaLinux, Rocky, RHEL
dnf install -y nftables

Gadzira faira remutemo:

cat > /etc/cve-2026-98432.nft <<'EOF'
table ip cve_2026_98432 {
    chain pre {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength gt 5 counter drop
    }
}
EOF

Kuti mutemo udzorerwe mushure mekutangisa kwega kwega, gadzira sevhisi yesystemd:

cat > /etc/systemd/system/cve-2026-98432.service <<'EOF'
[Unit]
Description=Mitigation for CVE-2026-98432
After=network-pre.target nftables.service firewalld.service ufw.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=-/usr/sbin/nft delete table ip cve_2026_98432
ExecStart=/usr/sbin/nft -f /etc/cve-2026-98432.nft
ExecStop=/usr/sbin/nft delete table ip cve_2026_98432

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now cve-2026-98432.service

Tarisa kuti mutemo wacho waiswa here:

nft list table ip cve_2026_98432

Kana ukavhurazve sevhisi yenftables ne global flush ruleset tonga, mhanya systemctl restart cve-2026-98432 shure kwaizvozvo.

Zvakakosha: musashandise mutemo uyu pama network muchishandisa maCIPSO labels (SELinux kana Smack NetLabel) — IP options dzinoshandiswa ipapo. Kana server yako ikaendesa traffic kune mamwe machina, mutemo wacho uchadonhedzawo mapaketi avo eTCP ane IP options.

Dzima MPTCP kana usingaidi

sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled = 0" > /etc/sysctl.d/99-disable-mptcp.conf

Kurongeka uku kunongodzivirira chete itsva Masokisi eMPTCP haagadziriswe. Masevhisi ari kutoshanda acharamba achiteerera kuburikidza neMPTCP, saka tangazve sevhisi yese yakanyorwa na ss -lnMp uye iva nechokwadi chekuti zvinobuda hazvina chinhu.

PaAlmaLinux, MPTCP inodzimwa zvachose kunze kwekunge iwe waigonesa iwe pachako.

Dzima MPTCP muzvirongwa zveGo

Kune masevhisi akavakwa neGo 1.24 kana gare gare, unogona kudzima MPTCP nechinhu chinoshanduka nharaunda. Semuenzaniso, kune sevhisi inonzi myservice:

systemctl edit myservice

Wedzera zvinotevera kufaira rinovhura:

[Service]
Environment=GODEBUG=multipathtcp=0

Wobva watangazve basa:

systemctl restart myservice

Gadziridza Xray

Kana sevha yako ichishandisa Xray, igadzirise ku v26.10.31 kana kuti gare gare. Shanduro yapfuura, v26.10.29, yakabviswa nevagadziri vayo. Iyi update inodzima MPTCP asi haigadzirise kernel, saka kernel update ichiri kudiwa.

Tarisa imwe setting

Nzira yechipiri, yakamanikana yekushandisa inoda kuti chikumbiro chekufambisa chishande. Chinodzima zvachose — ita shuwa kuti chakadaro:

sysctl net.ipv4.tcp_migrate_req

Murairo unofanira kudhinda 0.

Dzivisa mukana wekuwana masevhisi ako

Vhara firewall port yese isingade kuwanikwa kubva pa internet. Kana zvichibvira, vhura masevhisi ekutonga — SSH, ma control panels, ma database — chete kune kero dze IP dzakavimbika.

Danho rechina. Mushure mekuisa kernel yakagadziriswa

1. Tangazve sevha uye shandisa mirairo kubva kuDanho 1 kuti usimbise kuti kernel yakagadziriswa iri kushanda.
2. Unogona kubvisa mutemo wechinguvana:
   

   systemctl disable --now cve-2026-98432.service
   rm /etc/systemd/system/cve-2026-98432.service /etc/cve-2026-98432.nft
   systemctl daemon-reload

   
   
3. Kana uchida MPTCP, dzorera gadziriro yacho: bvisa /etc/sysctl.d/99-disable-mptcp.conf uye mhanya sysctl -w net.mptcp.enabled=1.

Kana chimwe chinhu chisina kumira zvakanaka

Kana sevha yako ikasatanga kushanda mushure mekuvandudza kernel, batanidza uchishandisa VNC console iri mu control panel uye sarudza kernel yapfuura mumenyu yekutanga. Kana usina chokwadi chekuti unogona kuzviita wega, kana kuti unoda rubatsiro nekuvandudza, taura nechikwata chedu chekutsigira.