🚨 PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.
What to do today:
1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.
2. If your distro has a fix, update and reboot.
3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.
4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.
5. Make it survive a reboot, and check it still works after one.
If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.
Self-hosting is freedom. Patching is part of the job. 🛡️
Derek Ross
npub18a…tp424
2026-10-30 14:35:30 UTC
Author Public Key
npub18ams6ewn5aj2n3wt2qawzglx9mr4nzksxhvrdc4gzrecw7n5tvjqctp424Published at
2026-10-30 14:35:30 UTCEvent JSON
{
"id": "606b2621f4a440bba14892d36e8bd7a1f5922e736ef1567e9b5c098af60debce",
"pubkey": "3f770d65d3a764a9c5cb503ae123e62ec7598ad035d836e2a810f3877a745b24",
"created_at": 1793370930,
"kind": 1,
"tags": [
[
"client",
"Ditto",
"31990:781a1527055f74c1f70230f10384609b34548f8ab6a0a6caa74025827f9fdae5:ditto"
]
],
"content": "🚨 PSA for anyone running a Linux server, node, or relay\n\nCVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.\n\nUbuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.\n\nWhat to do today:\n\n1. Check your kernel: uname -r\nFixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.\n\n2. If your distro has a fix, update and reboot.\n\n3. If not, block the attack. It needs TCP packets with \"IP options,\" which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.\n\n4. Turn off MPTCP unless you need it:\nsysctl -w net.mptcp.enabled=0\nPrograms built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.\n\n5. Make it survive a reboot, and check it still works after one.\n\nIf you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.\n\nSelf-hosting is freedom. Patching is part of the job. 🛡️",
"sig": "557022ba2a92411b644ee4c5e555c4d1252582ea53d23cc2742ab869e63de11c1ce284a51ff23c9b9ee59368f197945f218b0ad434e9ad84505e6213b4bfa601"
}