Linux稳定版内核于2026年10月发布补丁，修复了编号为CVE-2026-98432的严重安全漏洞 1。该漏洞位于IPv4 TCP握手过程中，属于Use-After-Free类型，CVSS 3.1评分高达9.8（Critical级别） 1。攻击者无需身份认证或凭据，即可通过远程方式利用此漏洞获取目标系统的root权限 1。受影响范围涵盖Linux内核4.4及以上版本，主要涉及IPv4 TCP连接场景 1。
Anthropic的研究人员披露，其AI模型Claude成功编写出针对具备多路径TCP监听器的Linux服务器的概念验证利用代码 1。据称，该利用程序首先耗时48分钟泄露内核指针，随后再需5分钟即可执行shell命令并以root身份运行 1。尽管Linux上游已在2026年10月11日和15日分别发布修复补丁，并将特定内核版本列入已修复列表，但截至10月29日，Ubuntu所有版本仍被标记为易受攻击状态，Red Hat RHEL 8/9/10也尚未提供官方补丁 1。相比之下，Debian、SUSE部分版本、Oracle UEK以及Amazon Linux 2023的特定内核版本已完成修复 1。
目前GitHub上已有8个仓库引用该CVE，其中一个描述了触发竞争条件的具体方法，但该漏洞尚未被列入CISA已知被利用漏洞目录（KEV） 1。在发行版补丁完全覆盖之前，建议采取的临时缓解措施是丢弃包含Record Route或Timestamp等IPv4选项的TCP SYN包 1。
Linux stable kernel maintainers patched a critical use-after-free vulnerability in the IPv4 TCP handshake process, identified as CVE-2026-98432, with fixes released on October 11 and 15, 2026 1. The flaw carries a CVSS 3.1 score of 9.8 (Critical) and allows unauthenticated remote attackers to gain root privileges without credentials on Linux kernels version 4.4 and above, primarily affecting IPv4 TCP connections 1. While the core kernel issue has been addressed in versions including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3, major distributions remain in varying states of remediation 1. As of October 29, Ubuntu marked all versions as vulnerable, and Red Hat Enterprise Linux 8, 9, and 10 are affected with no official patches available, whereas Debian, SUSE, Oracle UEK, and specific Amazon Linux 2023 kernels have provided fixes 1.
Anthropic researchers disclosed that their AI model, Claude, generated a functional proof-of-concept exploit targeting Linux servers equipped with multi-path TCP listeners 1. The exploit requires approximately 48 minutes to leak kernel pointers, followed by an additional five minutes to execute shell commands with root privileges 1. Although the vulnerability has not yet been added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, eight public repositories on GitHub reference the CVE, with one detailing a race condition trigger 1. System administrators seeking immediate mitigation can drop TCP SYN packets containing IPv4 options such as Record Route or Timestamp 1.
评论
还没有评论，欢迎留下第一条。