HN

Comments (86)

• Menu

  debinguy
  I find it odd that no public discussions are highlighting that iptables or nftables can drop this before the kernel CVE is exploitable by a U32 drop rule in raw PREROUTING...sudo iptables -t raw -I PREROUTING -p tcp -m u32 ! --u32 "0>>24&0x0F=5" -j DROP
• Menu

  c0l0
  It's rather uninteresting to note, once again, that Ubuntu has decided to do this. I would like to know the (official, if any - unofficial/speculative otherwise) reason WHY they have not.It does not seem that complicated to patch, and kernel upgrades are a dime a dozen these days. So what is making them delay a fix for so long?
• Menu

  harry8
  Question:Every consumer router-wirelessAP I've seen runs linux.I never see security upgrades for the kernels they use. Not one. Not ever.Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.Update: The context which I should have said is that I think LLMs are giving script kids nation state level tools and expertise. This known bug is always less interesting than the next twenty.
• Menu

  majorchord
  They also don't provide any mitigation possibilities or instructions... RHEL has one method here: https://access.redhat.com/security/vulnerabilities/RHSB-2026...However they also claim the mitigation "reduces exposure to this vulnerability but cannot fully prevent it", without elaborating on what that means or how it would be possible... I've also not seen anyone else make this claim.
• drnick1
  I have been running pure Debian for years on my router/home server. Ubuntu is a superset of Debian that adds mostly adds stuff that is irrelevant for a networking device. Just stick to base distributions unless you are a very good reason not to.
• jimrandomh
  I was previously Ubuntu-by-default for my random Linux boxen, but going to upgrade things and finding that Ubuntu didn't have a patch has shaken my faith in it. I probably won't choose it for new servers in the future.
• jordemort
  Surely there is a more reputable source for this story than a blog stapled to a stolen IRC network
• gnabgib
  Discussion (842 points, 422 comments) https://news.ycombinator.com/item?id=50337608
• Menu

  pelagicAustral
  I have not seen an exploit in the wild. I have at least 20 different servers unpatched (obviously) but the risk is blown way out of proportion. There are a number of mitigation options available.
• sivakon
  https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...you can use proposed pocket as per this for latest LTS releases
• mbac32768
  Can't tell if Ubuntu is smart for deferring this patch until a bigger periodic release because there's no evidence it's been exploited and its exploitability is quite limited or if Ubuntu is dumb because there's a lot of publicity around this CVE and it comes off as failing to read the room.
• Menu

  superkuh
  For those not aware: Freenode.net is not Freenode as we all knew and loved it from the early 2000s to 2021. A hostile take-over of the Freenode LLC resulted in the loss of the domain name and some corporate assets. And the hostile takeover person, Andrew Lee, deleted the Freenode database. It no longer exists."Freenode" in 2026 is an entity actively hostile to open source software and while what they say here might be true, they are only saying it because it aligns with their biases. They are not a real news source.My mitigation for this lack of patches has been using iptables. iptables -A INPUT -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP
• TutleCpt
  switched to Debian not that long ago. Living the life now.
• Menu

  warpspin
  It's not a zero-day if it's not the zeroth day anymore :-)
• snapplebobapple
  Does ucore hace a patch yet? I justfinished moving all my stuff off ubuntu to ucore last week
• anon
  undefined
• Menu

  jon128
  CiCD of Gentoo based systems patched this as early as any other system.I am hoping to see an indication that https://grsecurity.net/ patches preemptively mitigated CVE-2026-98432 but I'm feeling less optimistic.This vulnerability has been a stark reminder to why in some places things are running on HardenedBSD instead of Linux.
• Menu

  TZubiri
  RIPUbuntu was always the benefits of Debian without the inconvenient restrictions anyways, it wouldn't be surprising if their contradictive philosophy caused them to collapse by inability to eat the cake while having it simultaneously.I've switched to Debian in professional servers around the time I learned how to use it without a Graphical Desktop Environments, that's roughly the stage at which a growing devleoper should drop the Ubuntu training wheels. Don't carry that into the workplace whenever possible.
• lousken
  They are busy migrating to rust, ubuntu will be safe soon, don't worry anyone!
• beaconflint
  [flagged]
• Menu

  h1bslop
  [flagged]
• Menu

  TacticalCoder
  How do we feel now about having pointless services listening for no good reason on open ports?And do we feel about running no firewall?For example Linux works totally fine without running dhcpcd and without running avahi. But on many systems where people think they run "no service", these two shall have ports open on your network and happily listening.Sure, it's typically "only" on your LAN: but how long before we see exploits affecting even private LANs?Tighten your stuff up guys.
• Menu

  ay
  Just block the ingress IPv4 packets with IP options using nftables or iptables and move on.Why does everything has to come with so much drama these days.