Beta Branch add cmsec CVE-2026-98432 IPv4 TCP ireq_opt UAF kernel check in 140.00…

add cmsec CVE-2026-98432 IPv4 TCP ireq_opt UAF kernel check in 140.00beta01

CVE-2026-98432 (CVSS 9.8) is a remote use-after-free in the IPv4 TCP SYN
path: tcp_v4_syn_recv_sock() hands ireq_opt to the child socket without a
copy, so a retransmitted SYN can then read the freed IP options. It is
reachable on any listening IPv4 TCP port before an application sees the
connection.

Changes:
- New tools/cmm-security/checks/check-cve-2026-98432.sh, run as
cmsec check cve-2026-98432 and in the dmotd banner when DMOTD_CVECHECK='y'
- Verdict comes from the fix entry in the running kernel's rpm changelog
first; AlmaLinux 8/9/10 fixed NVRs are used only when the changelog can't
be read
- AlmaLinux ships the fixed kernels in almalinux-testing only so far, so the
suggested actions give a one-line testing-repo kernel upgrade
- Detects the AlmaLinux/Red Hat nftables workaround that drops IPv4 TCP
packets carrying IP options, and whether it is re-applied at boot
- Prints the workaround with its own systemd unit to load it at boot; CSF's
csfpre.sh is not used because a normal CSF boot restores its saved rules
without running it
- Reports net.mptcp.enabled and net.ipv4.tcp_migrate_req (information only)
- Linode kernels are compared against the upstream stable fixes; stock
EL6/EL7 kernels and CloudLinux 7 are reported not affected
- Verified on AlmaLinux 8.10/9.8/10.2 and Rocky Linux 9.8/10.2, including
reboots with CSF 16.32/16.33 and firewalld

---

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01