Interestingly, Ubuntu Priority is set to "High" and not "Critical" which is defined as:
reply"A significant problem, typically exploitable for nearly all users in a default installation of Ubuntu. Includes serious remote denial of service, local root privilege escalations, local data theft, and data loss."
Makes you wonder what the critical level is for
replyRemote RCE/data theft basically, as opposed to the local of High: https://ubuntu.com/security/cves/about#priority
replyAh, I misread the first comment and thought it said remote execution, not remote denial
reply> https://ubuntu.com/security/CVE-2026-98432
replyThe listed kernels are in the "proposed" component (and not yet in "security" or "udpates") if you want to pull them down onto canary systems for testing before going to production.
so just block multipath and add the firewall rule from article that drops packets with IPv4 options
replyBoth of which we are finding out are apparently insufficient to mitigate this.
reply"the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection."
replyIs iptables considered an "application" here? I.e. can this bug be triggered before iptables drops the packet?
Put OpenBSD in front to protect that little scared penguin.
replyHoping fix will be out soon so we don’t have to.
reply