Derek Ross on nostr

Open in Damus

@Derek Ross 1793370930

🚨 PSA for anyone running a Linux server, node, or relay

CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.

Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.

What to do today:

1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.

2. If your distro has a fix, update and reboot.

3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.

4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.

5. Make it survive a reboot, and check it still works after one.

If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.

Self-hosting is freedom. Patching is part of the job. 🛡️

2349❤️41👀5❤️3👍2🤙2🫠2

Important to note that sudo sysctl -w net.mptcp.enabled=0 prevents *new* MPTCP sockets from being created, but it does not retroactively convert existing listeners. A restart of any services already using MPTCP is still needed. use `sudo ss -Mlnp` before and after to make sure you're good 🤙

Dentroy Scout · 1w

Ran the vendor trackers just now so people can see where their distro stands on CVE-2026-98432: - Debian: fixed. bookworm 6.1.190-1 (DLA-4841-1), trixie 6.12.113-1 (DSA-6568-1), matching your version list. - Red Hat: RHEL 8, 9 and 10 listed as Affected, no fix yet. They score it 8.1 (attack complex...

Miki Black · 1w

I'm just closing the laptop till there's a fix on Ubuntu...

Oh just a 9.8 on every Linux server. 🤣

Leo Wandersleb · 1w

The "take over" part was theoretical yesterday or is this the second such kernel bug in 24h?

Thanks for sharing

Emmett Brown ⚡ · 1w

One thing missing from most guides: Go 1.24+ enables MPTCP by default for all listeners. So your LND, your relay, your watchtower are all MPTCP-enabled unless you explicitly turned it off. The attack surface is larger than just nodes that opted in. Check before assuming you're not affected.

Cameri🐲 · 1w

Fuck it, im taking everything offline 👋

Nordic Pagan 🇫🇮🇸🇪🇳🇴 · 1w

One more reason to run Debian instead of Ubuntu.

I've been plodding along at making a Nostr powered RSS reader to replace my FreshRSS instance (the last traditional self hosted web service I'm running). I think this, and the million other CVEs in the last week or so, is my sign to migrate away from traditional self hosting.

https://blossom.jumble.social/1d4e06927f0b333d1e2a3d5108e772ec7e4255ea14d90325fbb3eb178080033d.gif

Majestic Entity · 1w

If I had the motivation and was evil, I could just simply take over the world with this vuln?

protozoan numbness · 1w

Updated my node. Thanks.

unSATiated · 1w

nostr:nevent1qqsgwdusatprtvgxrt79jtcmascc62737ru8s4lgzejpf45q7wvjl4gzyp26g5xracy2qklpdj09kr3a2yp25r2zk48q6yyhr9umhx8p3x9rxqcyqqqqqqgav8kv8

𝖓𝖔𝖊𝖗𝖒𝖘 · 1w

Is StartOS affected by this?

Majestic Entity · 1w

Thank you for this information. I found out my node had MPTCP enabled and I disabled it.

We are looking for an individual who can lend 185,000 US dollars to our holding company. We are seeking an investor capable of investing 185,000 US dollars in our holding company. We will establish an animation film production company using the 185,000 US dollars you will lend to our holding compa...