A major 9.5/10 CVE has just hit linux's TCP stackIf you have a machine connected to the internet, TAKE IT OFFLINE
shut the fuck up, you don't tell other people what to do that's my job
Summary: Upgrading: 352, Installing: 4, Removing: 0, Not Upgrading: 16 Download size: 876 MB Space needed: 41.3 MB / 3,285 MB available
>>110198623what if I keep my omarchy dssktop online?
>>110198623wow thank you, Sir Raj The Savvy
magic packet
>>110198643Absolutely nothing will happen but you should upgrade your kernel regardless it's always good for you and the wider internet community in general to be running safe secure softwarepanicy bullshit like OP is annoying though
dont hack me alright?
it's only for mptcp. this is the biggest who fucking cares of the month
>>110198674>9.8/10 score
>>110198683just update, thanks for the heads up i guess but it's really this simple: if command -v pacman >/dev/null; then sudo pacman -Syu; elif command -v apt-get >/dev/null; then sudo apt-get update && sudo apt-get dist-upgrade -y; elif command -v dnf >/dev/null; then sudo dnf upgrade --refresh -y; elif command -v emerge >/dev/null; then sudo emerge --sync && sudo emerge -uDN @world; fi
if command -v pacman >/dev/null; then sudo pacman -Syu; elif command -v apt-get >/dev/null; then sudo apt-get update && sudo apt-get dist-upgrade -y; elif command -v dnf >/dev/null; then sudo dnf upgrade --refresh -y; elif command -v emerge >/dev/null; then sudo emerge --sync && sudo emerge -uDN @world; fi
>gufw>incoming: denyWow, that was hard.Oh wait it was already set to that because I'm not a fucking idiot.
>>110198693>Just update:$ wcurl https://github.com/torvalds/linux/archive/refs/heads/master.tar.gz % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:02 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 1 second. 5 retries left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:02 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 2 seconds. 4 retries left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:02 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 4 seconds. 3 retries left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:03 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 8 seconds. 2 retries left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:02 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 16 seconds. 1 retry left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:03 0curl: (22) The requested URL returned error: 429Thanks a lot Microsoft you useless shits
$ wcurl https://github.com/torvalds/linux/archive/refs/heads/master.tar.gz % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:02 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 1 second. 5 retries left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:02 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 2 seconds. 4 retries left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:02 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 4 seconds. 3 retries left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:03 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 8 seconds. 2 retries left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:02 0curl: (22) The requested URL returned error: 429Warning: Problem : HTTP error. Retrying in 16 seconds. 1 retry left. 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00:03 0curl: (22) The requested URL returned error: 429
>>110198623this is so fucking annoying already every time I go online I read about some exploit sysadmin will be the job of the future
>"with multipath enabled">check kernel>already had it disabledI sleep
>>110199076I'm pretty sure I had it disabled too. Still good practice to patch anyway.# uname -aLinux OpenWrt 7.4.0-rc0 #1 SMP PREEMPT_RT Fri Oct 30 01:18:59 UTC 2026 x86_64 GNU/LinuxI've gotten into the habit of building kernels daily now with how much vulnerabilities have been dropping lately. Compiling a kernel is quick and rebooting into it daily with kexec is quick. I could probably even automate it.
>>110198758>wcurl
youtube screenshot threads are worse than xitter screenshot threadskill yourself OP
>>110199193>Blaming curlIt's literally better than wget/wget2. It's a server problem not a client problem.Microsoft did eventually let me download the fucking tarball by the time I finished cloning from Google over git they let me grab it.Git clones have been so unreliable lately. Is this because of all of the shitty AI agents?
>>110198623If they wrote this in Rust there wouldn't be an issue.
>>110198628Immediately filtered. Bye forever.
>>110199216>It's literally better than wget/wget2.wget and curl serve different purposes.>>110199224we're going to plap you. hard.
>>110199303>wget and curl serve different purposes.Yes, wget has some spidering capabilities to mirror a website. I'm not doing that.
>>110199222wrong.rcu can only be done in unsafe rust. unsafe rust is unsafe.
>>110199473unsafe rust doesn't turn off the borrow checker so no.
>>110199543borrow checker doesn't even protect against race conditions in safe rust. so yes, rust gains you nothing here.
>>110199767You don't even know what the borrow checker is judging by your response.Your stupid comment is like complaining that a seatbelt didn't protect your from STDs.
>>110198623NIGGER
>>110198623Rust did it again... yeeahh fucked up everything.
>>110199848borrow checker doesn't make race conditions impossible. unsafe rust makes uaf possible. you get the exact same critical flaw as in c.
>>110198623>If you have a machine connected to the internetanon, having a computer with an internet connection available to it and having a computer with a WAN IP are two different things. You are fine
>>110200004what on earth are you talking about? You clearly don't know what the borrow checker is. You keep talking about STDs and Seatbelts. They're not the same thing. The borrow checker isn't turned off in unsafe rust.
>>110198623so what? what are they going to do to my computers?
>>110200053They're going to probe your computers anus. Patch now!!!
>>110200049borrow checker doesn't work on raw pointers.here's your memory corruption despite rust.https://lore.kernel.org/linux-cve-announce/2025121614-CVE-2025-68260-558d@gregkh/T/#u>In the Linux kernel, the following vulnerability has been resolved:>>rust_binder: fix race condition on death_list>>Rust Binder contains the following unsafe operation:>> // SAFETY: A `NodeDeath` is never inserted into the death list> // of any node other than its owner, so it is either in this> // death list or in no death list.> unsafe { node_inner.death_list.remove(self) };>>This operation is unsafe because when touching the prev/next pointers of>a list element, we have to ensure that no other thread is also touching>them in parallel. If the node is present in the list that `remove` is>called on, then that is fine because we have exclusive access to that>list. If the node is not in any list, then it's also ok. But if it's>present in a different list that may be accessed in parallel, then that>may be a data race on the prev/next pointers.>>And unfortunately that is exactly what is happening here. In>Node::release, we:>> 1. Take the lock.> 2. Move all items to a local list on the stack.> 3. Drop the lock.> 4. Iterate the local list on the stack.>>Combined with threads using the unsafe remove method on the original>list, this leads to memory corruption of the prev/next pointers.
>>110198623>If you have a machine connected to the internet, TAKE IT OFFLINEI will not, faggot
>>110200178again you don't seem to understand what the borrow checker is. If you knew you would be pointing out obvious shit. Now you're saying condom don't protect you from car crashes.Ownership rules still apply when working with raw pointers.
>canonical still hasn't released a patch
>>110198623> unaffected from 7.2.8 through 7.2.*< $ uname -r< 7.2.11-zen1-1-zenWhoa it's fucking nothing
>>110198623>If you have a machine connected to the internet, TAKE IT OFFLINEBut I need my router to connect to the internet.>most people missing their routers run linux kernels
>>110198623
>>110198623>Sir Raj
A Linux TCP stack just flew over my house!
can't hack or anythin i have nortron
>>110199473it's only unsafe if it has not been audited. comments should expain what every line of unsafe rust does along with an explanation to auditors why the unsafe rust was needed. put this in your agents.md and see what happens
I'm using Trisquel GNU/Linux, what do I do? It is the latest version
>>110202989dont forget
>>110202250Who are these sexy boys?
Who gives a shit? Captain Picard died.
>>110203036the old world is slowly dying
>>110203036For all those in the Star Trek fandom I'm sure this will be very difficult for them. For the most extreme Star Trek superfans they might need to be restrained so that they do not kill themselves.
>>110198623Is that what pic-related was talking about?I see no kernel update, though.
https://www.publichealth.columbia.edu/news/study-examines-suicide-contagion-following-celebrity-deaths-opening-avenues-prevention
>>110198623wtf i just heard about this on the radio
>>110198623Nothingburger status?
>>110198623>TAKE IT OFFLINEWhy? It was patched on 7.2.10 and 7.3I am running 7.3
>>110204148I haven't updated and my Linux machine is fi
>>110198693>sudongmi
>>110199076every single meme ai-generated CVE is either that or outright fake.
>>110198623But has it been exploited yet?
>>110199222asterinas doesn't have this problem
>>110198623>HOOOOOOOOOO
>>110204987The vulnerability is not limited to multipath, but it's what they wrote the exploit for.
THERE ARE TOO MANY VULNERABILITIESEVERYTHING IS GETTING HACKED
>>110206972Life is good.As an average person, you still have basically nothing to worry about. But now we are getting into all the things.
>>110198623uh oh stinky
New 10.0 CVE just droppedNo emudra requiredhttps://www.cve.org/CVERecord?id=CVE-2026-112816
>>110206972BASEDACCELERATEHACK THE PLANET
Prepare for more vulnerabilities to be introduced into the kernel as Linus permits a flood slop code with zero quality control to be merged. The ride never ends!
>>110207114God, luddites are so fucking stupid it's unreal.
>>110207188Luddites can debug and maintain their code. You cannot.
>>110207114All of the recent vulns were caused by years old commits from retard human coders
>>110207199They evidently can't, have you not been paying attention?
>>110207208>All of the recent vulns were caused by years old commits from retard human codersAnd the next will be commits from retard computer coders.
>>110198653If you're running Ubuntu/Redhat, you can't yet. They have't patched it. But everybody else can just disable multi-channel TCP and you should be good until they do.
>>110207366What do you mean you can't retard?https://ubuntu.com/kernel/docs/how-to/develop-customise/build-kernel/Follow this and build from the upstream kernel.org sourceFor RHEL you can google the documentation yourself
>>110207401>>110207366Ubuntu builds daily kernels you can literally just grab an up-to-date mainline kernel:https://kernel.ubuntu.com/mainline/daily/current/
>>110207401>Hey boss, can I push I push a custom built kernel out to our fleet. I'll be super duper careful. No? Okay.
So I just checked and every Ubuntu install has security updates automatically enabled to run daily. So this is a nothing burger. Thank you.
>>110207470https://ubuntu.com/security/cve-2026-98432
Can I get a definition of nothing burger, please? Is there a threshold of things happening needed to qualify it as something burger?
>>110207492Almost nobody uses Multi Path TCP so it's a nothing burger. Update anyway though.Multi Path TCP is cool and I've thought of experimenting with something like:https://www.openmptcprouter.com/I don't have multiple WANs though. If I had multiple fibre lines or Starlink or LTE alongside I'd definitely be playing with this stuff.
>>110198623i have vulnslop fatigue
>>110207478Yeah, they're taking a shit ton of time to fix this. So it is a problem, but it's a nothing burger. I have nothing to do
>>110207492>nothing burgerIt's when a big deal is made about something that doesn't affect anyone.
>>110207366>But everybody else can just disable multi-channel TCP and you should be good until they do.red hat says otherwisehttps://access.redhat.com/security/vulnerabilities/RHSB-2026-016>Mitigation>Filter Incoming IPv4 Packets Containing IP Options>The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it. Ordinary application traffic is generally expected to remain unaffected, because standard TCP options are carried in the TCP header and continue to be permitted.
>>110207709How in the fuck did Debian, of all distros, get a patch about before fucking Red Hat.
>>110207532>Almost nobody uses Multi Path TCP so it's a nothing burger.wronghttps://groups.google.com/g/golang-announce/c/PCoQcdxoScw/m/aD-MgXEvAAAJ>As of Go 1.24 <https://go.dev/doc/godebug#go-124>, Go programs enable MPTCP by >default for listen sockets on Linux.
>>110207731debian didn't do anything.anthropic is retarded and dropped this flaw without any responsible disclosure because it accidentally got fixed in upstream mainline/stable kernels. so anthropic thought it's fine to just make it public.any distro that doesn't use upstream mainline/stable kernels got fucked since you don't backport random patches. debian uses upstream stable kernels.
>>110207733>Go programsSo almost nobody.
>>110207733Okay, let me revise that:>Almost nobody except Go is using thisI guarantee your web server isn't unless you're using Caddy in which case you deserve it. Should have used Nginx.
>>110207733>>110207761It doesn't have to be enabled as in used in the listen call, it just has to be enabled in the kernel, retards
>>110207771If there is nothing doing MPTCP it doesn't matter that the kernel is vulnerable
>>110207749Wait, I thought Debian issued specific fixes for CVEs? For example, 6.12.113-1, which fixed this 2 weeks ago when PenEscape came out?
>>110207771wrong, mptcp is just one of many tcp ip options that can trigger the flawhttps://access.redhat.com/security/vulnerabilities/RHSB-2026-016>A use-after-free vulnerability was found in the Linux kernel's IPv4 networking subsystem. A remote, unauthenticated attacker could exploit a race condition during TCP connection request processing to trigger remote code execution. The flaw arises when socket options are freed while still being accessed by a concurrent operation, such as a retransmitted connection request or a socket migration. Exploitation requires precise timing of network requests but does not require any privileges or user interaction.>This vulnerability affects any system running a vulnerable kernel version with IPv4 TCP networking enabled. Since TCP is fundamental to nearly all networked services, the affected surface is broad. Systems accepting inbound TCP connections are most directly exposed.mitigation is >>110207709, not disabling mptcp
>>110207812Nothing else sets those options. But yes, hypothetically if you had some other service doing weird stuff with options it could be vulnerable.
>>110207788no, upstream 6.12.113 fixed penescape (and this tcp flaw)https://lwn.net/Articles/1100611/debian carries its own patches but follows upstream stable kernels.
using a vpn will fix this right
Also most ISPs and nat routers will filter out or outright remove the ip options header. Just got the sflow log from my org and 100% of the packets coming from upstream have a clean header (20 bytes), tried sending ip packets with options and they were all stripped of the ip options.
>>110207434Then you just fucking wait for the official kernel to release and update. Boring as fuck. Still winning.
>>110207943>Still winning.
>>110207434Just patch the live kernel with the kernel live patching infrastructure to do that
Also have been nooticing most of the cves are some idiot doing optimizations for stuff no one asked, like the whole copyfail a few months ago.These people should be investigated, maybe they are state agents?
>>110207958I really hate the simpsons and how it has become more popular in the culture
>>110207990mptcp is innocent and should be used everywherehttps://github.com/golang/go/issues/82717#issuecomment-6533615722>By having MPTCP enabled by default on the listener side, it helps clients to easily benefit from MPTCP: seamless handovers, best network selection, network aggregation, etc. As mentioned on the mptcp.dev website, having a listening MPTCP socket is cheap and, when MPTCP is not requested by the client, "plain" TCP sockets will continue to be used by the server, so no perf impact for existing traffic.>While I'm here, for the people who are worry about this CVE, please note that the reproducer used by Anthropic in their "ad" was in a lab, sending a huge number of connections requests, using MPTCP because by luck it "only" took them 48 minutes, less than with TCP, and I'm pretty sure IPv4 options are already blocked in many networks by default for different security reasons. So it seems very unlikely to have this attack working outside a lab. I have no idea how they got a 9.8 score in some places, but I agree that it helped them to make a good press release / ad thanks to that.>[...]
>>110208018
>>110207933So you're saying... CloudFlare may inadvertantly be a good chunk of the user space?
>>110207835>Nothing else sets those options.makes no sense.mptcp doesn't use any ip options. like red hat says "The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it. Ordinary application traffic is generally expected to remain unaffected, because standard TCP options are carried in the TCP header and continue to be permitted."mptcp uses tcp options and continues to work.
>>110198623Another vibeGOD victory
>>110208066Dont gayphones already use cloudflare as proxy?
>>110208066it's best practice to drop ip optionshttps://www.rfc-editor.org/info/rfc7126>Recommendations on Filtering of IPv4 Packets Containing IPv4 Options>[...]>We note that data seems to indicate that there is a current>widespread practice of blocking IPv4 optioned packets.>[...]>Broadly speaking, any IP packet that requires processing by an IP>router's general-purpose CPU can be a DDoS risk to that router's>general-purpose CPU (and thus to the router itself).>[...]
>>110198623>Multipath TCPso 5 servers across the world in total are vulnerable, got it
>>110208263I would check your VMs if I were you. We had more with it enabled than I would have ever suspected. I still don't know why.
>>110208275I think Golang likes to use it as default.
>>110208263wrong.mptcp only speeds up the exploit. mptcp is not where the flaw is.
>>110208275which distro?rhel has mptcp disabled by default.https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_and_managing_networking/getting-started-with-multipath-tcp
>>110208409>>110208275well we will fucking see now won't we
>>110208465https://github.com/sgInnora/innora-cve-research/tree/main/CVE-2026-98432
>>110208589aw shucks, oh well thank you
>>110208589>>110208629verified my own build anywho
>>110198623I GOT NORTON
I didn't update and I noticed in my logs a bunch of cat .env files I didn't make, plus it's now filled to the brim with zip bombs, damn
>>110209087>no prooffag
>>110207812Huh! Why are socket options "freed" and what does that mean? I thought low-level C people in particular love bit flags, which is warranted, except they do it retardedly and unsafely most of the time.Oh wait, does the bitflags data itself allocated and freed manually? that would be a lol from me
>>110207812All my servers are single-core VMs and thus only affects multicore, so I’m not particularly worried.
>>110209109I made it all up I just like lying
>>110209208God doesn't like liars. Please stop or you'll go to hell when you die.
>tcp is compromised>can't download the fix without tcpIt's OVER for Linuxfags.
>>110209212I got nothing in life anyways ever since I got abused as a child then dumped by my ex 2 years ago
On a scale of 1-10 how fucked am I?
>>110208455>>110208275Ubuntu and Artix both have it enabled by default. Holy shit I've never had a public facing machine with a big RCE vulnerability like this before. I'm always so careful. I feel violated. I might actually switch to Rocky for my VM.
>>110210031Is it exposed to the public internet? If not I wouldn't worry about it.
>>110210068>Is it exposed to the public internet?Yes, this is my VPS.
>>110210078Then I would take it off the internet until a patch is released.
Wait this has been public for two weeks?
>>110207094MESS WITH THE BEST, DIE LIKE THE REST
>Linux starts getting market share because of gaming>Suddenly its source code gets more scrutinyWelcome to the club penguin bros, now you know how it feels to have malware.
>>110210031That's not MPTCP:grep -i mptcp /boot/config-$(uname -r)# CONFIG_MPTCP is not set
grep -i mptcp /boot/config-$(uname -r)# CONFIG_MPTCP is not set
>>110210138no, cve's severity was unknown till https://www.anthropic.com/research/discovering-vulnerabilities-with-claude>Oct 27, 2026>We have also found remotely triggerable (zero-click) arbitrary code execution vulnerabilities in the Linux kernel’s networking stack, which have since been patched upstream and publicly disclosed.
>>110209204wrong.concurrency ≠ parallelism
>>110210378I mean he's wrong but still probably fine since I imagine the VM hosts network will already be filtering the IP options.
>>110210405>VM hosts network will already be filtering the IP optionswronghttps://status.linode.com/incidents/nt58zhx3pmgm>Posted 9 hours ago. Oct 31, 2026 - 01:55 UTC>We are in the process of deploying mitigations for the underlying known attack vector while we continue to analyze any other possible impact.
>>110210279>/boot/config*what tard distro is this?>>110210031>doesn't know gzip ships with a "zgrep" scriptsad
>>110198623>the fix is in 7.3ok cool
>>110210487random distro's kernel ≠ upstream mainline kernelubuntu's 7.3 kernel is vulnerable:https://ubuntu.com/security/CVE-2026-98432>26.10 stonking>Vulnerable work in progress in 7.3.0-10.10
>>110210507ohI would lean towards gentoo being close to upstream though but I could not say for sure
>>110210507>>110210531https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1836b2357ye looks like it4chan thinks the link with the full git hash is spam omg
>>110210531ubuntu's kernel is close to upstream, too.the problem ishttps://documentation.ubuntu.com/release-notes/26.10/#linux-kernel-7-3>Ubuntu 26.10 ships with the Linux kernel 7.3. Because the final upstream 7.3 release is due after GA, the kernel in the release images (7.3.0-9.9) is based on 7.3-rc6.7.3-rc6 doesn't have the security fix yet. CVE-2026-99999 is also unfixed.https://ubuntu.com/security/CVE-2026-99999
>>110210632guess that is the curse of not being rolling release
>>110210476>what tard distro is this?Debian.
>>110210476what is wrong with /boot/config-
>>110210769>fixed 7.3.0 kernelwat
>>110210846because I have not run emerge @world today
>>110210274>Linux source code gets scrutiny>Unlike Windows it's immediately patched because the people affected by the bugs can patch/pay to patch it themselves instead of waiting for the worlds most expensive horde of Indians to find someone low caste enough to do it.
>>110212503wrong.this is a shitshow with major distros like rhel and ubuntu not having patches ready because neither the reporter nor upstream kernel talked to distros.https://www.openwall.com/lists/oss-security/2026/04/30/10>Note that for Linux kernel vulnerabilities, unless the reporter chooses to bring it to the linux-distros ML, there is no heads-up to distributions.
>>110212503these kind of toctou bugs are only found by llms when source is available. so public source is a disadvantage.
>>110213891>is a disadvantageyou're a braindead niggerfaggotCVEs in public sources will get found out and patched firstclosed source can easily be decompiled and reversed using LLMs, but their patching either goes unmentioned or they don't do it
>>110214016a decompile isn't precise enough to find toctou bugs
>>110213859Upstream kernel NEVER talks to distros that's not their business. They just build the damn thing and push out stable kernels you can compile yourself from kernel.orgI highly recommend you learn how to compile the kernel yourself because this sort of thing is going to become more common.
>>110214227And yes, there are security lists and sometimes co-ordination but it they immediately become aware of a problem they patch it then and there and don't retrospectively apply an embargo when everyone already knows.
>>110214227the flaw was fixed by a facebook employee. facebook is the biggest rhel clone shop in the world. facebook should give back to red hat, not just take.
>>110214227>you can compile yourself from kernel.orgnot recommendedhttps://www.gentoo.org/news/2026/05/19/copy-fail-fragnesia-vulnerabilities.html>Please note that only sys-kernel/gentoo-kernel, sys-kernel/gentoo-kernel-bin and sys-kernel/gentoo-sources packages are security-supported. The vanilla kernel packages are vulnerable at the moment. Other kernel packages may carry fixes, but they usually are slower to be updated. Additionally, we recommend running the latest kernel version (~arch or latest stable LTS), as upstream does not reliably backport security fixes to older versions.
it can be easily mitigated with UFWgive your favorite LLM your /etc/ufw/before.rules file and ask where to correctly add the following lines:# CVE-2026-98432 mitigation: drop TCP SYNs carrying IP options-A ufw-before-input -p tcp --syn -m u32 --u32 "0>>24&0x0F=6:15" -j DROP
# CVE-2026-98432 mitigation: drop TCP SYNs carrying IP options-A ufw-before-input -p tcp --syn -m u32 --u32 "0>>24&0x0F=6:15" -j DROP
>>110214425wrong, not only syn packets can reach that uaf
by defnition a happening is when something happens, not a potential prelude to something possibly happening. Are we clear on that?
>>110198623Glad I'm NEETing it and don't have to deal with this shit.Anyway first the bug won't affect common web stacks. It's supposed to be a multipath tcp thing which your rinky dink service won't need and only go enables this by default.https://www.heise.de/en/news/Another-critical-Linux-TCP-IP-bug-uncovered-updates-underway-11506347.htmlAlso this is again LLM provider hype fuel, no public exploit is known we just have a claim that the bug is exploitable.Good riddance I guess, but if they weren't total faggots they'd notify the kernel devs privatly two weeks before they make a public blog about it.
>>110214334Grab Linus' tree. Sometimes it's more up-to-date than the stable kernel.>>110214241That's not how kernel development works. Fixes always go upstream to kernel.org first and distros second.
>>110214757There's also linux-next too if you really need something RIGHT NOW.https://www.kernel.org/doc/man-pages/linux-next.html
>>110203053It's still the same week
>>110199216aria2c (Aria2) is better than curl/wget{,2}.
>>110215139For torrents and if you need metalink support (although Wget2 has that too).Otherwise Curl is literally the defacto obligatory one and only HTTP client that matters and ever mattered and will ever matter.Other clients are still wondering if they should add HTTP/3 support whilst Daniel Steg-What's-His-Name is probably dreaming of a HTTP/4.
>>110204180anon are you there?
>>110198623Another cnile L. >inb4 retards try and downplay another cve.
>>110215248Because safe Rust code has no CV-
>>110215251How many of these are remotely exploitable like the PHP bugs and this? lol. Take your L like a man.
>>110215280Who is putting Rust on a server to begin with? To be remotely exploitable you have to have a user-base to exploit.
>>110215288Seeing you faggots cope and seethe is honestly unreal. You literally lost.
>>110215299I would say PHP is winning quite hard given it literally runs the Internet but keep coping in the corner because the two of you using Rust on your server aren't getting your cervix penetrated hard enough.
>>110214757>Fixes always go upstream to kernel.org first and distros second.wrong, you are replying to a gentoo post where this wasn't so
>>110214241Are you sure they don't just use Fedora?
>>110215321Gentoo is wrong. That would imply they wrote the patch themselves. The patches came from the mailing lists and the mailing lists are hosted…on kernel.org.What they mean is the vanilla sources they package in their repository hadn't been updated. You could still grab them yourself.
>>110215313I don't see how this is a win. PHP is a shit language with a shit interpreter and no amount of major version numbers will make it not a joke. >B-but it is used everywhere So is Windows. Doesn't meant anything. Clown ass nigga.
so what's the future going to be like? Are we going to take shit offline again or?How do goverments survive this? Their infra is fucking is in the stone age, you can't defend all your shit
>>110215408If it's so shit then why do people still use it? Your Ad hominem doesn't add up.The reality is there no better interpreted language on the web.>PythonToo slow>JavaScriptMemory hog>PerlToo greybeard>CGI scriptsToo insecure and held together with duct tape and glue and a hope and a prayer
>>110215438Because someone built their whole business on it 20+ years ago and it's "good enough" until it isn't. Same shit can be said about C. It's a joke. Move on and stop being a cnile bitch.
>>110215443>It's a joke but nobody has built a better language because everyone is in on itFunny.If you're so convinced:>Why don't you go vibe code a new interpreted language for the web written in Rust and then replace Wordpress, Drupal, Nextcloud, etc.
>>110198623ugh. Computers are so annoying.
>>110215332yes, facebook uses centos streamhttps://changelog.com/shipit/102#transcript>Managing Meta's millions of machines with Anita Zhang, engineerd managerd at Meta>Apr 25, 2024>When I started, we were doing like CentOS 6 to 7, and I think that probably took like a year or two to actually reach over like 99% of the fleet. And there’s always that trailing 1% that for some reason they can’t shut down their services, or they don’t want to drain [unintelligible 00:19:23.09] traffic, and things like that. But now we’re able to complete I’d say like 99% of the fleet in a year or less. We started doing a lot of validations sooner, so now we actually hook in Fedora ELN into our testing pipeline, and we start deploying parts of Fedora ELN and running our internal container tests against them. And so [unintelligible 00:19:49.01] a few system-wide distribution changes that will be ready once CentOS – I guess now CentOS Stream 10 is going to be released later this year.
>>110215521This is giving me legit ptsd.
so they fixed this 2 weeks ago but nobody knew? wouldn't you easily detect it by having an llm just look at important kernel diffs?
>>110216704No because not all diffs imply a security fix. To know the reason the LLM has to work out intent and if the commit message is some generic "re-organise code" then that probably won't help.
I dislike having to upgrade Linux in full.We should only have to upgrade part of the kernel and not rebuild the whole thing again.
>>110216780You can do live kernel patching:https://ubuntu.com/tutorials/enable-the-livepatch-serviceOr DIY (not necessarily easy but still possible):https://wiki.gentoo.org/wiki/Live_patching
>>110198623So is this a different one than the tcp/udp one from a few days ago? And it's worse? What are the mitigations?
>>110216765How often do patches hit the TCP/IP stack though? Even just knowing it got changed is a huge red flag
>>110216765>>110216847Also even prior to LLMs it would have been trivial to detect if was just "reorganize/refactor" or not because the actual implementation changes.
>>110216847Pretty often actually if you just got log --grep="TCP:", etc, they're always fucking touching the network code. Netdev gets so much done to it all of the time. It's not necessarily unusual.
>already running the patched versionthanks debian!
>>110215172Curl is dogshit over unstable connections. Aria2 beats the pants off it. I do tunnel over tunnel over tunnel connections and Aria2 works every time.
>>110217220I've never once had a problem with Curl stalling or disconnecting but then I also don't use it on unreliable Internet connections. If there's high latency, packet loss and low throughput then that's going to fuck aria2 too eventually and more parallel threads aren't going to make that situation any better.
