Open Source Lab incident
Critical Linux kernel TCP vulnerability (CVE-2026-98432)
Ongoing since 06:20 PM UTC, affecting Internal Monitoring and Internal Monitoring (Internal Monitoring — Salem, OR).
A critical flaw in the Linux kernel's IPv4 TCP code (CVE-2026-98432, CVSS 9.8) lets a remote attacker with no login crash the kernel, and possibly run code, by sending crafted packets to any open TCP port. If your project runs Linux on an OpenStack VM or a server that you manage yourself, please install your distribution's fixed kernel as soon as it is available and reboot into it. Who needs to act: - Projects that manage their own OpenStack VMs or colocated servers running Linux. Every distribution is affected. - Hosts that OSL manages for you: we have already applied the interim mitigation below and will reboot them onto fixed kernels in our normal maintenance windows, announced here as usual. Fix status (Nov 1): - Debian: fixed. Debian 13 in 6.12.113-1 (DSA-6568-1), Debian 12 in 6.1.190-1 (DLA-4841-1). - AlmaLinux 8, 9 and 10: fixed kernels are in the testing repository (4.18.0-553.180.2, 5.14.0-687.61.2, 6.12.0-211.69.2) and not yet in the regular updates. - RHEL and Ubuntu: no fixed kernel yet; Red Hat rates the flaw Critical and Ubuntu has fixes in progress. For other distributions, including those built from RHEL, check your vendor's security notices. Interim mitigation: Until you can reboot onto a fixed kernel, drop incoming IPv4 TCP packets that carry IP options, which normal traffic does not use. Red Hat's bulletin gives this nftables rule (run as root; it lasts until the next reboot): nft add table inet cve_2026_98432 nft add chain inet cve_2026_98432 input '{ type filter hook input priority -310 ; policy accept ; }' nft add rule inet cve_2026_98432 input ip protocol tcp ip hdrlength gt 5 counter drop If the VM runs Docker or other containers, add the same chain and rule with "forward" in place of "input" so container ports are covered too. Remove it after rebooting onto the fixed kernel with: nft delete table inet cve_2026_98432 Red Hat's bulletin: https://access.redhat.com/security/vulnerabilities/RHSB-2026-016 If you are unsure whether you are affected or need help, email [email protected].
Affected components
Update timeline
- identified Nov 01, 2026, 06:20 PM UTC
A critical flaw in the Linux kernel's IPv4 TCP code (CVE-2026-98432, CVSS 9.8) lets a remote attacker with no login crash the kernel, and possibly run code, by sending crafted packets to any open TCP port. If your project runs Linux on an OpenStack VM or a server that you manage yourself, please install your distribution's fixed kernel as soon as it is available and reboot into it. Who needs to act: - Projects that manage their own OpenStack VMs or colocated servers running Linux. Every distribution is affected. - Hosts that OSL manages for you: we have already applied the interim mitigation below and will reboot them onto fixed kernels in our normal maintenance windows, announced here as usual. Fix status (Nov 1): - Debian: fixed. Debian 13 in 6.12.113-1 (DSA-6568-1), Debian 12 in 6.1.190-1 (DLA-4841-1). - AlmaLinux 8, 9 and 10: fixed kernels are in the testing repository (4.18.0-553.180.2, 5.14.0-687.61.2, 6.12.0-211.69.2) and not yet in the regular updates. - RHEL and Ubuntu: no fixed kernel yet; Red Hat rates the flaw Critical and Ubuntu has fixes in progress. For other distributions, including those built from RHEL, check your vendor's security notices. Interim mitigation: Until you can reboot onto a fixed kernel, drop incoming IPv4 TCP packets that carry IP options, which normal traffic does not use. Red Hat's bulletin gives this nftables rule (run as root; it lasts until the next reboot): nft add table inet cve_2026_98432 nft add chain inet cve_2026_98432 input '{ type filter hook input priority -310 ; policy accept ; }' nft add rule inet cve_2026_98432 input ip protocol tcp ip hdrlength gt 5 counter drop If the VM runs Docker or other containers, add the same chain and rule with "forward" in place of "input" so container ports are covered too. Remove it after rebooting onto the fixed kernel with: nft delete table inet cve_2026_98432 Red Hat's bulletin: https://access.redhat.com/security/vulnerabilities/RHSB-2026-016 If you are unsure whether you are affected or need help, email [email protected].
Your product runs on more than Open Source Lab
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services