Critcal bug in TCP/IP-stack, remotely exploitable (CVE-2026-98432)

未关闭
  • 哪里不对？
#7,738 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
30/100
Issue 类型
缺陷
描述清晰度
需要澄清
活跃度
停滞
技术栈
c, linux
领域
operating-systems, security

调研方向

Start by comparing the reported Raspberry Pi kernel version, 6.18.50+rpt-rpi-v8, with the upstream kernel versions listed as fixed and the linked CVE details. The issue names no source files or tests, so first determine whether this Raspberry Pi kernel is affected and whether the upstream fix is present. Done means confirming the vulnerability applies to this build and identifying a reproducible failure or a missing fix.

由索引模型根据 Issue 内容生成。

描述

Describe the bug

A critical vulnerability in the Linux kernel’s networking code affects nearly all Linux distributions, including Debian, Red Hat, Suse and Ubuntu. The problem lies in the TCP/IP stack, where attackers can exploit it over a network to inject and run their own code (remote code execution, CVSS 9.8, the highest severity level). The kernel team has already released a fix, however, and the first distributors have published updates.

Anthropic’s Claude recently uncovered this critical security vulnerability while systematically testing major projects. It had gone undetected in the Linux kernel code used by millions of systems for almost exactly 11 years. The issue is a race condition that can let an attacker make the victim’s Linux kernel use memory on one CPU that another CPU had just freed. This leads to unexpected memory access, which the attacker can coordinate to run injected code. Claude demonstrated this with a working exploit, and Anthropic reported the bug to the Linux kernel team.

The faulty code was committed on Oct. 2, 2015, in kernel version 4.4, and was reviewed and approved by several experts. Only a systematic search by AI brought it to light. On Oct. 15, 11 years after the commit, Greg Kroah-Hartman confirmed that the bug, CVE-2026-98432, had been fixed in kernel versions 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7.

The vulnerability affects all IPv4 implementations since Linux kernel version 4.4; IPv6 is not affected. Linux distributors are currently working hard to provide updated kernels for affected products that are still supported. Advisories from Debian, Red Hat, Suse and Ubuntu provide the latest information. Administrators should install patched kernels as soon as they become available.

Little is known so far about the specific threat posed by this vulnerability. The only known exploit so far comes from Anthropic and is not publicly available. It targets so-called Multipath TCP (MPTCP) connections. MPTCP is a TCP option that a server service must explicitly request; only Go applications enable it by default. However, it is unclear whether an MPTCP service must actually be running on the target system for an attack to work. So far, we know nothing about specific attacks or what they would look like.

Steps to reproduce the behaviour

description tells - so far there's no known exploit, but I'd wager it'll only be a matter of time.

CVE is linked above for more details

Device (s)

Raspberry Pi 4 Mod. B

System

Raspberry Pi reference 2023-12-11
Generated using pi-gen, https://github.com/RPi-Distro/pi-gen, 2acf7afcba7d11500313a7b93bb55a2aae20b2d6, stage2

Sep 14 2026 14:49:30
Copyright (c) 2012 Broadcom
version a86983925695a7e63166327d7c002d64040ed31d (clean) (release) (start)

Linux rpi 6.18.50+rpt-rpi-v8 #1 SMP PREEMPT Debian 1:6.18.50-1+rpt1 (2026-09-11) aarch64 GNU/Linux

Logs

No response

Additional context

No response

主要语言
C
星标
13.3k
派生
5.5k
平均合并
3 天 20 小时
30 天内合并 PR
27

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

raspberrypi/linux 的其他 Issue

查看 raspberrypi/linux 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。