I-CVE-2026-98432 sikhala endleleni i-kernel ye-Linux leyemukela ngayo ticelo tekuchumana kwe-TCP. Sivumela umhlaseli loku khashane, ngaphandle kweliphasiwedi, kutsi awise iseva nobe onakalise inkhumbulo ye-kernel. Licembu le-CVE le-kernel ye-Linux lisinika emaphuzu langu-9.8 kulangu-10, futsi i-Anthropic itsi imodeli yayo i-Claude ibhale ikhodi yekuhlasela leniketa umhlaseli emandla e-root kuseva leyemukela kuchumana kwe-MPTCP. Kulungiswa sekukhona ku-kernel lenkhulu futsi i-Debian seyikukhiphile, kodvwa kuze kube mhla ti-30 Imphala 2026 i-Ubuntu isakubala njenge-"work in progress" (kusasetjentwa) ku-22.04, 24.04 na-26.04, kantsi i-Red Hat ibala i-RHEL 8, 9 na-10 njengaletitsintsekile futsi tingenako kubuyeketa. Kuze kufike kubuyeketa: cisha i-MPTCP nangabe ungayidzingi, vimba emaphakethe e-IPv4 laphetse tinketfo te-IP, unciphise labo labangafinyelela emaseva akho, futsi uhlele sikhatsi sekucalisa kabusha.

Yini i-CVE-2026-98432, futsi kungani ibalulekile enkampanini yakho?

Ngekusho kwe-lirekhodi le-CVE lelisemtsetfweni, sikhala sitfolakala ngesikhatsi kuphela kubingelelana kwe-TCP nge-IPv4: i-kernel inika kuchumana lokusha tinketfo te-IP letigcinwe kanye nesicelo sekuchumana ngaphandle kwekutikopisha, kantsi ngaso leso sikhatsi lenye i-CPU ingase isebente ngesicelo lesiphindziwe futsi yakhe imphendvulo ngaleto tinketfo. Nangabe i-kernel ikhulula leyo nkhumbulo kucala, iyabe seyiyifundza ngemuva kwekuyikhulula, liphutsa lelatiwa ngekutsi yi-use-after-free. Lesikhala sikhona kusukela ku-kernel 4.4. Licembu le-CVE le-kernel lasishicilela mhla ti-15 Imphala 2026 futsi lasinika emaphuzu langu-9.8 kulangu-10 ngobe singafinyelelwa ngenethiwekhi, ngesikhatsi sekubingelelana nangaphambi kwekungena nobe kunjani, ngaphandle kwekutsi umsebentisi enteni lutfo.

Ku-sitfunyelwa samhla ti-27 Imphala, i-Anthropic yatsi i-Claude ibhale ikhodi yekuhlasela levumela umhlaseli loku khashane longenato tincwadzi tekungena kutsi asebentise imiyalo njenge-root kuseva te-Linux letemukela kuchumana kwe-MPTCP, lokungu-TCP lenetindlela letinyenti. Ekuhloleni kwayo, lekhodi yatsatsa imizuzu lengu-48 kuvuta likheli enkhumbulweni ye-kernel, yase itsatsa imizuzu lengu-5 kufinyelela ekusebentiseni imiyalo. Lokubi kakhulu kutsi kuzama lokuhlulekile akuyiwisi iseva; kuhluleka lokuchumana kuphela, ngako-ke umhlaseli angachubeka azama ngaphandle kwekutsi kube khona lobonako. I-Anthropic ayizange ishicilele lekhodi yekuhlasela ngokwayo.

I-Red Hat ichaza umtselela lomkhulu njengekuwa kweseva nekwenqatjwa kwensita (denial of service), kanye nekonakala lokungenteka kwenkhumbulo. Embhalweni wamhla ti-30 Imphala we-luhlu lwe-CISA lwetikhala letatiwako letisetjentisiwe, lesikhala besingakafakwa.

Kubuyeketa sekufikile yini ku-distribution yakho?

Nasi simo lesasikhonjiswa likhasi lelisemtsetfweni la-distribution ngayinye mhla ti-30 Imphala 2026:

I-distributionSimo
Ubuntu 22.04, 24.04, 26.04 na-26.10Isengotini, kulungiswa ku-"work in progress" (kusasetjentwa); ku-24.04 ku-kernel 6.8.0-149 (likhasi le-Ubuntu)
Ubuntu 16.04, 18.04 na-20.04Isengotini
Red Hat Enterprise Linux 8, 9 na-10Iyatsintseka, kute kubuyeketa lokukhishiwe (likhasi le-Red Hat)
Red Hat Enterprise Linux 6 na-7Ayitsintseki
Debian 12 na-13Kulungisiwe ku-6.1.190-1 nase-6.12.113-1 (sigcini-mlandvo se-Debian)

Ku-kernel lenkhulu, kulungiswa kwafika etinguculweni 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 na-7.3. Kodvwa emaseva lamanyenti asebentisa i-kernel ye-distribution yawo, ngako-ke lokubalulekile likhasi le-distribution yakho, hhayi inombolo yenguculo ye-kernel lenkhulu.

Ungati njani kutsi iseva isengotini yini?

Sebentisa leyimiyalo kuseva ngayinye ye-Linux leyemukela kuchumana kusuka ku-inthanethi:

uname -r
cat /proc/sys/net/mptcp/enabled
ss -Mln
cat /proc/sys/net/ipv4/tcp_migrate_req
  • Wekucala ukhombisa inguculo ye-kernel; uyicatsanise nelikhasi le-distribution yakho. Ku-Ubuntu 24.04, ngekwesibonelo, yonkhe inguculo lekhona lamuhla ayikalungiswa.
  • Inani lelingu-1 kulowesibili lisho kutsi i-MPTCP ivuliwe, lokuyindlela lejwayelekile ngekusho kwe-imibhalo ye-kernel.
  • Wesitsatfu ubala tinsita letemukela kuchumana kwe-MPTCP. Nobe nguyiphi insita levelako ilihlobo lelitfwala i-Anthropic lelalisebentisa. Naka tinhlelo letibhalwe nge-Go: ngekusho kwe-emanotsi ekukhishwa kwe-Go 1.24, ema-listener ato manje asebentisa i-MPTCP ngendlela lejwayelekile lapho isekelwa khona.
  • Wesine kufanele akhombise 0; ngekusho kwelirekhodi le-CVE, indlela yesibili yalesikhala isebenta kuphela nangabe lelinani lingu-1.

Likhambi lesikhashana kuze kufike kubuyeketa: tinyatselo letingu-5

  1. Nangabe i-distribution yakho seyinako kulungiswa, kufake nyalo bese ucalisa kabusha. Ku-Debian 12 na-13, ngekwesibonelo: 
    sudo apt update && sudo apt upgrade
sudo reboot
    I-kernel lensha ayikuvikeli kuze kube iseva seyisebenta ngayo.
  2. Cisha i-MPTCP nangabe kute insita leyidzingako. Loku kuvala luhlobo lwelitfwala i-Anthropic lelalisebentisa: 
    sudo sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled = 0" | sudo tee /etc/sysctl.d/99-disable-mptcp.conf
    Umyalo wekucala usebentisa lesilungiselelo masinyane; wesibili usigcina ngemuva kwekucalisa kabusha. Imibhalo ye-kernel itsi lesilungiselelo sisebenta ngalinye ligama lenethiwekhi (network namespace), ngako-ke sisebentise nangekhatsi kwema-container. Tinhlelo te-Go tibuyela ngekwato ku-TCP lejwayelekile nangabe i-MPTCP ingekho. Kodvwa i-Anthropic nobe nguyiphi i-distribution akukho lokutsi kuyicisha kucedza sikhala ngokwaso, ngako-ke loku kunciphisa bungoti esikhundleni sekubelapha.
  3. Vimba emaphakethe e-TCP laphetse tinketfo te-IPv4. Simo sekunika emaphuzu kulirekhodi le-CVE sicabanga umhlaseli lotfumela sicelo sekuchumana lesinenketfo ye-IPv4 Record Route nobe Timestamp, kantsi kuhamba kwemininingwane kwewebhu, i-imeyili ne-SSH lokujwayelekile akudzingi leto tinketfo. Cela umphatsi wenethiwekhi yakho umtsetfo we-firewall lolahla emaphakethe e-TCP langenako lanesihloko se-IPv4 lesidze kwengca ema-byte langu-20, bese uwuhlola kucala kuseva yinye. Kute i-distribution letsi loku kuyasivimba sikhala, kodvwa kususa simo lesicatsangwa ngulamaphuzu.
  4. Nciphisa labo labangafinyelela emaseva akho. Lesikhala sidzinga i-port ye-TCP levulekile leyemukela kuchumana, ngako-ke vala yonkhe i-port longayidzingi, futsi ushiye i-SSH nemaphaneli ekuphatsa afinyeleleka kuphela kusuka emakhelini e-IP latsite nobe nge-VPN. Nangabe iwebhusayithi iseceleni kwemlamuli lofana ne-CDN, vumela iseva lenkhulu kutsi yemukele kuchumana kuphela kusuka emakhelini alensita.
  5. Lungiselela kubuyeketa ngaphambi kwekutsi kufike. Landzela emakhasi e-Ubuntu ne-Red Hat ngalesi-CVE, vumela kubuyeketa kwe-kernel kusenesikhatsi futsi ubeke sikhatsi sekucalisa kabusha, kuze kulungiswa kufakwe ngalo lilanga lekukhishwa kwako. Bhekisisa i-log ye-kernel kutsi ayikabi nekuwa lokukhuluma nge-ip_options_build: 
    sudo journalctl -k | grep -i ip_options_build
    Kodvwa i-log lethulile ayisho kutsi uphephile, ngobe kuzama lokuhlulekile akuyiwisi iseva.

Kutsiwani nangabe emaseva akho akumhlinzeki we-hosting?

Ku-hosting lehlanganyelwe nakutinsita letiphatfwako, i-kernel ngeyemhlinzeki, hhayi yakho. Mbute imibuto lemitsatfu: ngabe emaseva akhe asebentisa yiphi i-distribution neyiphi inguculo ye-kernel, utakufaka nini kulungiswa, futsi wentani kuze kube ngaleso sikhatsi kunciphisa bungoti. Iseva lesitsekile lebonakalako (VPS) ivamise kushiya i-kernel etandleni takho, ngako-ke sebentisa tinyatselo letingenhla wena ngekwakho.

Umbono we-Origami

Njengobe kunjalo esihlokweni setfu mayelana netikhala te-PHP, nangabe kubuyeketa lokusemtsetfweni kubambeka, tinyatselo tesikhashana tito letivikela emaseva emalangeni ekucala. Kodvwa tinciphisa bungoti kuphela; kuphela kwelikhambi yi-kernel lelungisiwe ngemuva kwekucalisa kabusha. Ku-Origami singahlola emaseva akho e-Linux, sisebentise tinyatselo tesikhashana ngaphandle kwekuphazamisa tinsita takho, futsi sifake kulungiswa nasekukhishwa nje. Xhumana natsi.

Lokubalulekile

  • I-CVE-2026-98432 sikhala se-kernel ye-Linux lesinikwe emaphuzu langu-9.8 kulangu-10 licembu le-kernel, lesihlasela iseva kusuka khashane ngesikhatsi sekubingelelana kwe-TCP, ngaphambi kwekungena nobe kunjani.
  • I-Debian seyikhiphe kulungiswa; i-Ubuntu ne-Red Hat bebangakakwenti loko kuze kube mhla ti-30 Imphala 2026.
  • Kuze bakwente: cisha i-MPTCP nangabe ungayidzingi, vimba emaphakethe e-TCP laphetse tinketfo te-IPv4, futsi uvale ema-port longawasebentisi.
  • Faka i-kernel lelungisiwe nasekukhishwa nje bese ucalisa kabusha; tinyatselo tesikhashana atitsatsi indzawo yayo.

Imitfombo