• Saturday, October 31, 2026

The recently disclosed Linux kernel vulnerability CVE-2026-98432 affects every Linux system with a TCP port open to the internet (SSH, proxies, websites). It can be exploited remotely without any credentials. The flaw is in the kernel itself, so changing ports or using stronger passwords does not help. Windows systems are not affected.

Please follow the steps below on your VPS as soon as possible. Each step is a single block of commands: copy the whole block, paste it into your SSH terminal, and press Enter. The whole process takes about 2 minutes.

Step 1: Log in to your VPS as root and check your OS

cat /etc/os-release | head -n 2

If it shows Debian, go to Step 2. If it shows Ubuntu, go to Step 3.

Step 2: Debian 12 / 13 — the official fix is available; upgrade and reboot

apt-get update && apt-get full-upgrade -y && reboot

Once the system has rebooted, the fix is in place (Debian 12: linux 6.1.190-1, Debian 13: linux 6.12.113-1). Nothing else is needed.

Step 3: Ubuntu 22.04 / 24.04 — the official fix is not yet in the stable updates; enable the temporary protection first

The commands below make the system drop TCP connection requests that carry IPv4 options, which is exactly what triggers this vulnerability. Normal SSH, web and proxy traffic does not use IPv4 options and is not affected. The protection loads automatically at boot, so you only need to run this once.

apt-get update && apt-get install -y nftables
mkdir -p /etc/nftables.d
cat >/etc/nftables.d/cve-2026-98432.nft <<'EOF'
table inet cve_2026_98432 {
  chain input {
    type filter hook input priority -310; policy accept;
    ip protocol tcp ip hdrlength > 5 counter drop
  }
}
EOF
cat >/etc/systemd/system/cve-2026-98432-nft.service <<'EOF'
[Unit]
Description=CVE-2026-98432 temporary mitigation
After=network-pre.target
Wants=network-pre.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /etc/nftables.d/cve-2026-98432.nft
ExecStop=/usr/sbin/nft delete table inet cve_2026_98432

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now cve-2026-98432-nft.service
nft list table inet cve_2026_98432

If the last line of output contains ip protocol tcp ip hdrlength > 5 counter, the protection is active.

If you prefer to run the commands one at a time and see what each step does, follow the order below. The result is the same as the single block above.

(1) Install the nftables firewall tool:

apt-get update && apt-get install -y nftables

(2) Create the rule file that drops TCP packets carrying IPv4 options:

mkdir -p /etc/nftables.d
cat >/etc/nftables.d/cve-2026-98432.nft <<'EOF'
table inet cve_2026_98432 {
  chain input {
    type filter hook input priority -310; policy accept;
    ip protocol tcp ip hdrlength > 5 counter drop
  }
}
EOF

(3) Create a systemd service so the rule loads automatically at every boot:

cat >/etc/systemd/system/cve-2026-98432-nft.service <<'EOF'
[Unit]
Description=CVE-2026-98432 temporary mitigation
After=network-pre.target
Wants=network-pre.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /etc/nftables.d/cve-2026-98432.nft
ExecStop=/usr/sbin/nft delete table inet cve_2026_98432

[Install]
WantedBy=multi-user.target
EOF

(4) Enable the service and load the rule now:

systemctl daemon-reload
systemctl enable --now cve-2026-98432-nft.service

(5) Confirm the rule is active:

nft list table inet cve_2026_98432

Step 4: Ubuntu users — watch for the official kernel update

Keep an eye on Ubuntu's official kernel security updates and keep your system updated. Once an official kernel update states that CVE-2026-98432 is fixed, run the following to upgrade and reboot, then remove the temporary protection:

apt-get update && apt-get full-upgrade -y && reboot

After the reboot:

systemctl disable --now cve-2026-98432-nft.service

Socks-VPS users: v1.5.0 includes the same protection for your SOCKS ports. Run sudo socks-vpsctl update to upgrade. SSH and any other open ports still need the steps above.

If you run into any problems, please feel free to submit a support ticket.

Thank you for your business,
NovixLink

Back