Nuglaanta Kernel-ka ee Muhiimka ah ee Linux CVE-2026-98432: Sida loo hubiyo oo loo cusbooneysiiyo VPS-gaaga

Bishii Oktoobar 2026, nuglaansho halis ah, CVE-2026-98432 , ayaa laga helay kernel-ka Linux, kaasoo lagu qiimeeyay 9.8 ka mid ah 10 cabbirka CVSS. Waxay saamaysaa sida loo maareeyo xiriirada IPv4 TCP ee soo socda, xaalado gaar ahna, waxay u oggolaanaysaa weeraryahan inuu si fog u helo xididka server-ka - iyada oo aan lahayn eray sir ah iyo ficil looga baahan yahay maamulaha.

Hoos waxaa ku qoran cidda ay saameysay, sida loo hubiyo server-kaaga iyo sida loo ilaaliyo. Dhammaan amarrada waxaa loo maamulaa sidii root ama la socda. sudo.

Nuglaanta oo kooban

• Waa maxay: cillad isticmaal la'aan ah oo ku jirta koodka kaas oo dejiya xiriirada IPv4 TCP, oo ay sababto xaalad tartan. Weeraryahanku wuxuu u diraa baakado si gaar ah loo sameeyay dekedda TCP ee furan.
• Kernellada ay saameysay: nooc kasta tan iyo Linux 4.4, taasoo la macno ah ku dhawaad ​​​​qaybin kasta oo hadda jirta.
• IPv6 cayayaanka ugu weyn saameyn kuma yeesho.
• Halkee ayay khatartu dhab tahay: Cilmi-baarayaasha cilmiga aadanaha ayaa muujiyay silsilad faa'iido doon ah oo shaqeyneysa oo heshay marin xidid server ah oo leh Multipath TCP (MPTCP) oo la suurtageliyay qiyaastii 53 daqiiqo gudahood. Koodhka faa'iidada lama daabicin.
• Weerarrada ka dhaca duurjoogta: laga bilaabo Noofambar 1, 2026, lama soo sheegin wax ka faa'iidaysi ah. Taasi waa sabab loo cusbooneysiiyo si deggan, ee maaha sabab dib loogu dhigo.

Adeegyada Go waxay leeyihiin khatar gooni ah. Tan iyo Go 1.24, barnaamijyada server-ka ee Linux waxay dhageystaan ​​​​dekedaha iyagoo adeegsanaya MPTCP si caadi ah mar kasta oo kernel-ku u oggolaado. Maamuluhu xitaa ma ogaan karo in server-koodu uu aqbalo xiriiradaas. Barnaamijyada caanka ah dhexdooda, Xray wuxuu u shaqeeyaa sidan - horumariyayaashu waxay horey u sii daayeen nooc degdeg ah, v26.10.31, kaas oo curyaaminaya MPTCP si caadi ah.

VPS kastaa wuxuu ku shaqeeyaa kernel-kiisa, markaa waxaad u baahan tahay inaad cusboonaysiiso kernel-ka gudaha server-kaaga. Annaga lafteena ayaa cusboonaysiinaysa qanjidhada virtualization-ka.

Ma jiraa xal loogu talagalay nidaamkaaga

Xaaladda laga bilaabo Noofambar 1, 2026. Hagaajinta ayaa soo degeysa ku dhawaad ​​​​maalin kasta - hubi xiriiriyeyaasha dhammaadka maqaalkan si aad u ogaato xaaladda hadda jirta.

Tallaabada 1. Hubi kernel-ka aad ku shaqeyneyso

Soo ogow nooca kernel-ka socda:

uname -r

Lambarka nooca kaliya waxba kuuma sheegayo: qaybinta backport waxay hagaajisaa kernels-kooda iyaga oo aan beddelin nooca aasaasiga ah. Waa wax lagu kalsoonaan karo in la hubiyo beddelka baakadka kernel - haddii uu xuso lambarka CVE, hagaajinta horeba waa loo rakibay.

Debian iyo Ubuntu:

apt changelog linux-image-$(uname -r) 2>/dev/null | grep CVE-2026-98432

Debian, oo ah uname -v amarku wuxuu sidoo kale muujinayaa nooca buuxa ee xirmada ee kernel-ka socda: isbarbardhig jadwalka kore.

AlmaLinux, Rocky Linux, RHEL, Oracle Linux:

rpm -q --changelog kernel-core-$(uname -r) | grep CVE-2026-98432

Haddii amarku uusan waxba daabicin, kernel-ka socda wuu nugul yahay.

Marka xigta, hubi adeegyada aqbala xiriirada iyada oo loo marayo MPTCP. Server-yada sidan oo kale ah ayaa ahaa bartilmaameedka weerarka la muujiyay:

ss -lnMp

Wax soo saar madhan macnaheedu waa inaysan jirin dhagaystayaal MPTCP ah.

Tallaabada 2. Ku rakib kernel-ka go'an

Qaado kayd ama sawir qaade server-kaaga ka hor intaadan cusboonaysiin kernel-ka.

Debian 12 iyo 13

Keernellada go'an waxay ku jiraan kaydka amniga. Hubi in ay shaqeyneyso:

grep -r security.debian.org /etc/apt/sources.list /etc/apt/sources.list.d/

Haddii aan waxba la helin, ku dar security.debian.org kaydin loogu talagalay sii deyntaada. Kadib cusbooneysii nidaamka:

apt update
apt full-upgrade
reboot

Ubuntu

Kernels-ka la hagaajiyay weli lama sii dayn. Hubi wixii cusbooneysiin ah:

apt update
apt list --upgradable | grep linux-image

Haddii server-kaagu ku xiran yahay Ubuntu Pro, waad hubin kartaa qorshaha hagaajinta:

pro fix CVE-2026-98432 --dry-run

Marka hagaajinta la sii daayo, rakib oo dib u bilow:

apt update
apt full-upgrade
reboot

Ilaa markaas, hubi inaad isticmaasho ilaalinta ku meel gaarka ah ee Tallaabada 3aad.

AlmaLinux 8, 9, 10

Kernels-ka go'an hadda waxaa laga heli karaa oo keliya kaydka tijaabada. Ku rakib haddii aad ku qanacsan tahay inaad sidaas ku sameyso server-ka wax soo saarka, oo hubi inaad sawir qaaddo ka hor intaadan cusbooneysiin:

dnf install -y almalinux-release-testing
dnf update 'kernel*' --enablerepo=almalinux-testing
dnf config-manager --disable almalinux-testing
reboot

Ka dib dib u bilaabista, isbarbardhig uname -r iyadoo la adeegsanayo noocyada ku jira jadwalka kore. Haddii aadan rabin inaad rakibto xirmooyinka tijaabada ah, mari ilaalinta ku meel gaarka ah oo sug inta hagaajintu ay gaarayso kaydka ugu weyn.

Rocky Linux iyo nidaamyada kale ee ku salaysan RHEL

Wali wax hagaajin ah ma jiro. Waxaad ka daawan kartaa:

dnf --refresh updateinfo info --all --cves CVE-2026-98432

Marka hagaajinta la sii daayo:

dnf update kernel
reboot

Ka dib markii la cusbooneysiiyo: dib u bilaabid ayaa loo baahan yahay

Kernel-ka cusub wuxuu dhaqan galayaa oo keliya ka dib dib-u-bilaabid. Si loo hubiyo in mid loo baahan yahay:

# Debian and Ubuntu
[ -f /var/run/reboot-required ] && echo "Reboot required"

# AlmaLinux, Rocky, RHEL
needs-restarting -r

Kadib dib u bilaabista, ku celi hubinta Tallaabada 1aad.

Tallaabada 3. Ilaalin ku meel gaar ah ilaa laga helo kernel go'an

Tallaabooyinkani waxay yareeyaan khatarta laakiin ma beddelaan cusbooneysiinta kernel-ka.

Xir xirmooyinka kicinta

Weerarku wuxuu adeegsadaa xirmooyinka TCP oo leh ikhtiyaarrada IP ee cinwaanka IPv4. Ku dhawaad ​​​​waligood kama muuqdaan taraafikada caadiga ah, RFC 7126-na waxay horey ugu talineysaa in la iska daayo. Xeerka nftables ee hoose wuxuu hoos u dhigayaa dhammaan xirmooyinka TCP ee soo socda ee IPv4 oo leh ikhtiyaarro mana saameynayo IPv6, UDP ama ICMP. Waxay la shaqeysaa ufw iyo firewalld.

Ku rakib nftables haddii aan hore loo rakibin:

# Debian and Ubuntu
apt install -y nftables

# AlmaLinux, Rocky, RHEL
dnf install -y nftables

Samee faylka xeerka:

cat > /etc/cve-2026-98432.nft <<'EOF'
table ip cve_2026_98432 {
    chain pre {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength gt 5 counter drop
    }
}
EOF

Si xeerka loo soo celiyo ka dib dib-u-bilaabid kasta, samee adeeg nidaamsan:

cat > /etc/systemd/system/cve-2026-98432.service <<'EOF'
[Unit]
Description=Mitigation for CVE-2026-98432
After=network-pre.target nftables.service firewalld.service ufw.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=-/usr/sbin/nft delete table ip cve_2026_98432
ExecStart=/usr/sbin/nft -f /etc/cve-2026-98432.nft
ExecStop=/usr/sbin/nft delete table ip cve_2026_98432

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now cve-2026-98432.service

Hubi in xeerku uu buuxsamay:

nft list table ip cve_2026_98432

Haddii aad dib u bilowdo adeegga nftables adoo adeegsanaya adeeg caalami ah flush ruleset sharci, orod systemctl restart cve-2026-98432 kadib.

Muhiim: ha ku dabaqin xeerkan shabakadaha isticmaalaya calaamadaha CIPSO (SELinux ama Smack NetLabel) — Xulashooyinka IP-ga ayaa si caadi ah halkaas loogu isticmaalaa. Haddii server-kaagu uu wado taraafikada mashiinnada kale, qaanuunku wuxuu sidoo kale ku ridi doonaa baakadahooda TCP oo leh ikhtiyaarrada IP.

Dami MPTCP haddii aadan u baahnayn

sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled = 0" > /etc/sysctl.d/99-disable-mptcp.conf

Dejintani waxay ka hortagtaa oo keliya cusub Siligga MPTCP in la abuuro. Adeegyada horey u shaqeynayay waxay sii wadi doonaan dhageysiga iyagoo adeegsanaya MPTCP, markaa dib u bilow adeeg kasta oo ku qoran liiska ss -lnMp oo hubi in wax soo saarkeedu hadda madhan yahay.

Dhanka AlmaLinux, MPTCP si caadi ah ayaa loo curyaamiyaa haddii aadan adigu karti u yeelan.

Dami barnaamijyada MPTCP in Go

Adeegyada lagu dhisay Go 1.24 ama wixii ka dambeeya, waxaad joojin kartaa MPTCP adigoo isticmaalaya doorsoome deegaan. Tusaale ahaan, adeeg la yiraahdo myservice:

systemctl edit myservice

Ku dar waxyaabaha soo socda faylka furmaya:

[Service]
Environment=GODEBUG=multipathtcp=0

Kadib dib u bilow adeegga:

systemctl restart myservice

Cusbooneysii Xray

Haddii server-kaagu uu ku shaqeeyo Xray, u cusbooneysii v26.10.31 ama ka dib. Noocii hore, v26.10.29, waxaa dib uga noqday horumariyayaashiisu. Cusboonaysiintani waxay curyaaminaysaa MPTCP laakiin ma hagaajinayso kernel-ka, markaa weli waa loo baahan yahay cusbooneysiin kernel ah.

Hubi hal dejin oo dheeraad ah

Waddo labaad oo cidhiidhi ah oo ka faa'iidaysiga ah waxay u baahan tahay codsiga socdaalka in la hawlgeliyo. Si caadi ah ayuu u dansan yahay - hubi inay tahay:

sysctl net.ipv4.tcp_migrate_req

Amarka waa inuu daabacaa 0.

Xaddid marin u helidda adeegyadaada

Xidh deked kasta oo dab-damis ah oo aan loo baahnayn in laga helo internetka. Meesha ay suurtogal tahay, fur adeegyada maamulka - SSH, guddiyada xakamaynta, kaydka xogta - oo keliya cinwaanada IP-ga ee la aamini karo.

Tallaabada 4. Ka dib marka la rakibo kernel-ka go'an

1. Dib u bilow server-ka oo isticmaal amarrada Tallaabada 1 si aad u xaqiijiso in kernel-ka go'an uu shaqeynayo.
2. Waad ka saari kartaa xeerka ku meel gaarka ah:
   

   systemctl disable --now cve-2026-98432.service
   rm /etc/systemd/system/cve-2026-98432.service /etc/cve-2026-98432.nft
   systemctl daemon-reload

   
   
3. Haddii aad u baahan tahay MPTCP, dib u soo celi dejinta: tirtir /etc/sysctl.d/99-disable-mptcp.conf oo orod sysctl -w net.mptcp.enabled=1.

Haddii ay wax qaldamaan

Haddii server-kaagu uusan shaqeynin ka dib cusboonaysiinta kernel-ka, ku xidh konsole-ka VNC ee guddiga xakamaynta oo dooro kernel-kii hore ee ku jira liiska boot-ka. Haddii aadan hubin inaad tan adigu samayn karto, ama aad u baahan tahay caawimo ku saabsan cusboonaysiinta, la xiriir kooxdayada taageerada.