Critcal bug in TCP/IP-stack, remotely exploitable (CVE-2026-98432)

未關閉
  • 哪裡不對？
#7,738 2 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
3-5 天
新手友好度
30/100
Issue 類型
缺陷
描述清晰度
需要釐清
活躍度
停滯
技術堆疊
c, linux
領域
operating-systems, security

研究方向

Start by comparing the reported Raspberry Pi kernel version, 6.18.50+rpt-rpi-v8, with the upstream kernel versions listed as fixed and the linked CVE details. The issue names no source files or tests, so first determine whether this Raspberry Pi kernel is affected and whether the upstream fix is present. Done means confirming the vulnerability applies to this build and identifying a reproducible failure or a missing fix.

由索引模型根據 Issue 內容生成。

描述

Describe the bug

A critical vulnerability in the Linux kernel’s networking code affects nearly all Linux distributions, including Debian, Red Hat, Suse and Ubuntu. The problem lies in the TCP/IP stack, where attackers can exploit it over a network to inject and run their own code (remote code execution, CVSS 9.8, the highest severity level). The kernel team has already released a fix, however, and the first distributors have published updates.

Anthropic’s Claude recently uncovered this critical security vulnerability while systematically testing major projects. It had gone undetected in the Linux kernel code used by millions of systems for almost exactly 11 years. The issue is a race condition that can let an attacker make the victim’s Linux kernel use memory on one CPU that another CPU had just freed. This leads to unexpected memory access, which the attacker can coordinate to run injected code. Claude demonstrated this with a working exploit, and Anthropic reported the bug to the Linux kernel team.

The faulty code was committed on Oct. 2, 2015, in kernel version 4.4, and was reviewed and approved by several experts. Only a systematic search by AI brought it to light. On Oct. 15, 11 years after the commit, Greg Kroah-Hartman confirmed that the bug, CVE-2026-98432, had been fixed in kernel versions 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7.

The vulnerability affects all IPv4 implementations since Linux kernel version 4.4; IPv6 is not affected. Linux distributors are currently working hard to provide updated kernels for affected products that are still supported. Advisories from Debian, Red Hat, Suse and Ubuntu provide the latest information. Administrators should install patched kernels as soon as they become available.

Little is known so far about the specific threat posed by this vulnerability. The only known exploit so far comes from Anthropic and is not publicly available. It targets so-called Multipath TCP (MPTCP) connections. MPTCP is a TCP option that a server service must explicitly request; only Go applications enable it by default. However, it is unclear whether an MPTCP service must actually be running on the target system for an attack to work. So far, we know nothing about specific attacks or what they would look like.

Steps to reproduce the behaviour

description tells - so far there's no known exploit, but I'd wager it'll only be a matter of time.

CVE is linked above for more details

Device (s)

Raspberry Pi 4 Mod. B

System

Raspberry Pi reference 2023-12-11
Generated using pi-gen, https://github.com/RPi-Distro/pi-gen, 2acf7afcba7d11500313a7b93bb55a2aae20b2d6, stage2

Sep 14 2026 14:49:30
Copyright (c) 2012 Broadcom
version a86983925695a7e63166327d7c002d64040ed31d (clean) (release) (start)

Linux rpi 6.18.50+rpt-rpi-v8 #1 SMP PREEMPT Debian 1:6.18.50-1+rpt1 (2026-09-11) aarch64 GNU/Linux

Logs

No response

Additional context

No response

主要語言
C
星號
13.3k
分支
5.5k
平均合併
3 天 20 小時
30 天內合併 PR
27

環境準備

這個專案沒有提供開發容器、Dockerfile 或貢獻指南，環境需要你自己搭建：先看它的 README，通用步驟見我們的新手貢獻指南。

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

raspberrypi/linux 的其他 Issue

查看 raspberrypi/linux 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。