CVE-2026-98432 nftables iptables 緩和策

iptables 版 (nftables 環境でも iptables-nft 互換レイヤが入っていれば利用可)

sudo iptables -t raw -I PREROUTING 1 -p tcp -m u32 --u32 '0>>24&0x0F=0x06:0x0F' -j DROP

nftables 版 (推奨: counter で遮断数を観測できる。ファイルに保存して sudo nft -f ファイル名 で読込む)

table inet cve_2026_98432 {
chain pre { type filter hook prerouting priority -310; policy accept;
ip protocol tcp ip hdrlength gt 5 counter drop; }
}

https://dnobori.cyber.ipa.go.jp/ppt/download/20261031/261031-HowToProtect-Linux-Kernel-CVE-2026-98432.pdf

nftables

sudo nft -f - <<'EOF'
add table ip cve_2026_98432
delete table ip cve_2026_98432
table ip cve_2026_98432 {
    chain prerouting {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength > 5 counter drop
    }
}
EOF

The nft command comes from the nftables package, which is installed together with firewalld. If it is missing, install it with sudo dnf install -y nftables first.

The rule does not survive a reboot. If you reboot before you can install the patched kernel, run the command again.

Check that the rule is active. The counter shows how many packets it has dropped:

sudo nft list table ip cve_2026_98432

https://almalinux.org/blog/2026-10-30-cve-2026-98432/

永続化はされない

iptables

Customers can disable IP Options to mitigate this with an IP tables rule. An example is provided below:

iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP

https://aws.amazon.com/jp/security/security-bulletins/2026-160-aws/

ufw

/etc/ufw/before.rules

# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT
の後に
# CVE-2026-98432 mitigation: drop TCP packets carrying IPv4 extended options
-A ufw-before-input -p tcp -m u32 --u32 "0>>24&0x0f=6:15" -j DROP
を追加して

sudo ufw reload