Ubuntu CVE-2026-98432 — IPv4 TCP ulanishlarini qayta ishlashdagi tanqidiy Linux yadrosi zaifligi uchun tuzatishlarni e'lon qildi. Uning CVSS 3.1 bahosi 9,8 va u masofadan kod bajarishga olib kelishi mumkin.
Ubuntu 22.04 LTS va undan yangi versiyalar uchun tuzatishlar -proposed omborida joylashgan, shuning uchun ular hali standart yangilanish kanalida emas.
Xato tcpv4synrecvsock() funksiyasidagi use-after-free (ishlatilgandan keyin ozod qilish) xatosidir. Bu funksiya ireq->ireq_opt egaligini nusxa ko'chirmasdan bola soketga o'tkazadi.
Agar boshqa CPU qayta yuborilgan SYN ni qayta ishlasa, bola soketning opsiyalari ozod qilingan paytda SYNACK qurishi mumkin. Yadro endi so'rov soketlari uchun tinglovchi qulfni ushlab turmagani sababli, bu poyga (race) hech narsa bilan to'xtatilmaydi.
Oddiy kfree() esa ipoptionsbuild() da osilib qolgan ko'rsatkichni qoldiradi. Yuqori oqim tuzatishi inetsockdestruct() va tcpv4reqskdestructor() da kfreercu() ga o'tadi. IPv6 birinchi muammo bilan ta'sirlanmagan.
Xato yaqinda ko'rilgan SCTPhantom use-after-free kabi xotira-umr xatolari sinfiga tegishli, bu yerda eskirgan havola ozod qilingan obyektga kirishga sabab bo'lgan.
Ubuntu Anthropic tomonidan yaratilgan eksploit hali e'lon qilinmaganini aytadi. U Multipath TCP (MPTCP) dan foydalanadi, lekin zaiflik MPTCP ga xos emas. Boshqa eksploit ma'lum emas.
| Chiqarilish | Holat |
|---|---|
| 14.04 Trusty | Ta'sirlanmagan |
| 16.04, 18.04, 20.04 | Tuzoqlash kutilmoqda |
| 22.04 Jammy | -proposed (5.15.0-203.213) |
| 24.04 Noble | -proposed (6.8.0-149.149) |
| 26.04 Resolute | -proposed (7.0.0-43.43) |
| 26.10 Stonking | 7.3.0-10.10 da tuzatilgan |
Ubuntu'ning ochiq kuzatuvchisi hali ham bu qurilishlarning bir nechtasini "ish jarayonida" deb ro'yxatga olgan, shuning uchun chiqarilish tuzatilgan deb o'ylashdan oldin uni tekshiring.
Ishlayotgan yadroni ko'rish uchun uname -r ni ishga tushiring. O'rnatilgan yadro paketlarini ro'yxatlash uchun dpkg -l 'linux-image*' | grep ^ii ni ishga tushiring. Ikkalasini yuqoridagi jadval bilan solishtiring.
Tuzatishlarni qo'llash uchun -proposed omborini yoqish bo'yicha Ubuntu ko'rsatmalariga amal qiling. -proposed dan paketlar standart tarzda yangilanmaydi, shuning uchun ularni apt install -t -proposed bilan aniq o'rnatishingiz kerak. Keyin qayta yuklang.
Canonical bu yo'l o'z qabul sinovlarini o'tkazadigan jamoalar uchun mos kelishini aytadi. Bu ularga 2000 dan ortiq sertifikatlangan server va qurilmalarni qamrab oladigan to'liq sertifikatlash siklidan tezroq harakat qilish imkonini beradi. Bu Canonical'ning yangi yadro chiqarish strategiyasiga mos keladi. Unga ko'ra, SRU sikllari ikki haftagacha qisqaradi va yadrolar har hafta chiqariladi.
Ubuntu 20.04 LTS va undan eski versiyalar Ubuntu Pro ni talab qiladi. 20.04 va 18.04 Kengaytirilgan Xavfsizlik Xizmat Ko'rsatishi (ESM) ostida, 16.04 va 14.04 esa Legacy qo'shimchasi bilan ESM ni talab qiladi.
Ba'zi manbalar MPTCP ni o'chirishni tavsiya qiladi. Ubuntu xavfsizlik jamoasi xavfsizlik yangilanishlari yagona mos yumshatish chorasi ekanligini aytadi, chunki zaiflik MPTCP ga xos emas.
CVE sahifasi kiruvchi IPv4 TCP paketlarini IP opsiyalari bilan tushiradigan vaqtinchalik nftables qoidasini ro'yxatga oladi. Bu xavfni kamaytiradi, lekin eksploitatsiyani to'liq oldini olmaydi. Shuningdek, u IPv4 opsiyalariga bog'liq har qanday ulanishni buzadi.
Yadro ochiqlari tezroq kelmoqda. Linux yadrosi jamoasi yaqinda 24 soat ichida taxminan 440 ta CVE maslahatini e'lon qildi, bu esa tuzatish quvurlarini zo'riqtiradi.
Administratorlar internetga ochiq Ubuntu serverlarini ustuvor qilishlari va taklif qilingan yadrolarni hozir sinab ko'rishlari kerak. Shuningdek, 18.04 dan 26.04 gacha Ubuntu chiqarilishlariga ta'sir qilgan Pedit COW imtiyoz oshirish zaifligi kabi boshqa yaqindagi yadro xatolaridan kelib chiqadigan ta'sirni ham ko'rib chiqing.
SOC ga tezkor to'xtatish uchun ogohlantirish kontekstini bering.16K SOC dan tahdid razvedkasini integratsiya qiling.
Ubuntu has published fixes for CVE-2026-98432, a critical Linux kernel flaw in IPv4 TCP connection handling. It carries a CVSS 3.1 score of 9.8 and can lead to remote code execution.
The fixes for Ubuntu 22.04 LTS and newer are in the -proposed pocket, so they are not yet in the default updates channel.
The bug is a use-after-free in tcpv4synrecvsock(). That function passes ownership of ireq->ireq_opt to the child socket without copying it.
If another CPU handles a retransmitted SYN, it can build a SYNACK while the child socket’s options are freed. Since the kernel stopped holding the listener lock for request sockets, nothing prevents this race.
A plain kfree() then leaves a dangling pointer in ipoptionsbuild(). The upstream fix switches to kfreercu() in inetsockdestruct() and tcpv4reqskdestructor(). IPv6 is not affected by the first issue.
The bug comes from the same class of memory-lifetime errors seen in recent kernel flaws such as the SCTPhantom use-after-free, where a stale reference caused freed-object access.
Ubuntu saysthe exploit Anthropic generated is still unreleased. It reportedly uses Multipath TCP (MPTCP), but the vulnerability is not specific to MPTCP. No other exploit is known.
| Release | Status |
|---|---|
| 14.04 Trusty | Not affected |
| 16.04, 18.04, 20.04 | Fix pending |
| 22.04 Jammy | -proposed (5.15.0-203.213) |
| 24.04 Noble | -proposed (6.8.0-149.149) |
| 26.04 Resolute | -proposed (7.0.0-43.43) |
| 26.10 Stonking | Fixed in 7.3.0-10.10 |
Ubuntu’s public tracker still lists several of these builds as “work in progress”, so check it before you assume a release is patched.
Run uname -r to see the running kernel. Run dpkg -l ‘linux-image*’ | grep ^ii to list installed kernel packages. Compare both against the table above.
To apply the fixes, follow Ubuntu’s instructions for enabling the -proposed pocket. Packages from -proposed are not upgraded by default, so you must install them explicitly with apt install -t -proposed. Reboot afterward.
Canonical says this route suits teams that run their own acceptance tests. It lets them move faster than the full certification cycle, which covers more than 2,000 certified servers and devices. This follows Canonical’s new kernel release strategy. Under it, SRU cycles shrink to two weeks, with kernels released weekly.
Ubuntu 20.04 LTS and older need Ubuntu Pro. 20.04 and 18.04 fall under Expanded Security Maintenance (ESM), while 16.04 and 14.04 require ESM with the Legacy add-on.
Some sources recommend disabling MPTCP. Ubuntu’s security team says security updates are the only appropriate mitigation, because the flaw is not MPTCP-specific.
The CVE page does list an interim nftables rule that drops incoming IPv4 TCP packets carrying IP options. It reduces risk but does not fully prevent exploitation. It also breaks any connection that depends on IPv4 options.
Kernel disclosures are arriving faster. The Linux kernel team recently published roughly 440 CVE advisories in 24 hours, which strains patch pipelines.
Admins should prioritize internet-facing Ubuntu servers and test the proposed kernels now. Also review exposure from other recent kernel bugs, such as the Pedit COW privilege-escalation flaw, which affected Ubuntu releases from 18.04 through 26.04.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.