archy/docs/security/CVE-2026-98432.md

CVE-2026-98432 release requirement

Verified issue and fix

This is an IPv4 TCP IP-options use-after-free, not an MPTCP-only bug. The kernel fix frees inet_opt and ireq_opt after an RCU grace period. A demonstrated exploit used MPTCP, but disabling MPTCP alone is not a complete fix.

Authoritative references checked on 2026-11-01:

• Linux CNA record
• Upstream fix e3f33b0a1d89
• Debian security tracker, referencing DSA-6568-1
• Go Security Team guidance

Debian trixie's fixed package floor is 6.12.113-1; bookworm's6.1 branch is 6.1.190-1. The Linux CNA also lists first-fixed stable kernels5.10.272, 5.15.223,6.6.159,6.18.56,7.2.10 and7.3. Version branches must be compared individually; a numerically higher but still-vulnerable branch is not accepted.

Existing Debian nodes

An administrator can run the narrowly scoped package installer:

sudo bash scripts/install-kernel-security.sh

It uses normal authenticated APT, checks the supported distribution/architecture and fixed candidate, installs only the kernel meta-package and dependencies, and retains previous kernels. It refuses unsupported vendor kernels and accidental series downgrades. It performs no automatic reboot, app cleanup or wallet change.

Installation alone does not fix the running kernel. After a controlled reboot:

sudo python3 scripts/kernel-security.py --running

Require fixed: true and reboot_acceptance: true, plus the node's normal health, wallet/identity, app-data and network preservation checks. --installed reports package availability only. --image RELEASE checks a selected offline image and never reports reboot acceptance. Package payload changes/unreadable files fail verification; intentional omission of ISO documentation is distinguished from kernel/module changes.

The installer requires python3-apt and records provenance with --installed --record-provenance. The helper downloads the exact installed archive from authenticated Debian APT indexes, verifies its SHA-256, and checks every regular payload file against that archive. It retains the archive digest, package identity and per-file SHA-256 values in /var/lib/archipelago/kernel-security/. Subsequent offline checks require this receipt and rehash the payload; a package name, version or clean dpkg --verify alone is insufficient. Only missing documentation under doc/man/lintian/linda is exempt, never changed documentation or missing boot/modules files.

Receipts inherit the administrator's APT/keyring and root filesystem trust; they are not independently signed Debian attestations. Do not configure trusted=yes or permit unauthenticated repositories. Release signing must bind the helper, receipt and payload together. Record the Debian InRelease signature verification and archive digest in the build evidence. A changed/absent receipt fails closed. --receipt-dir is for disposable qualification and must not point at user-writable storage in production. --running also checks the Debian build version in uname; it is an operational reboot check, not measured-boot attestation.

ISO and release qualification

The rootfs recipe checks its selected kernel and package floor. The installer environment explicitly enables trixie-security and checks the exact kernel it copies to ISO boot media. Kernel-audit source changes invalidate the rootfs cache. The disk installer checks installed kernel package evidence before completing. These source checks do not replace booting the exact ISO and installed target.

The release lane must include both kernel helpers with the OTA runtime scripts. Kernel installation must be performed by the appointed administrator/prerequisite path, not by adding generic root execution to the protected management process. Public OTA release acceptance requires fixed-kernel canary/reboot evidence in addition to D09 qualification and signed artifact verification.

Raspberry Pi and interim mitigations

A Raspberry Pi/vendor kernel requires its own vendor patch and boot-path qualification. The generic Debian installer deliberately refuses to replace an unrecognized vendor kernel. Do not describe a Go GODEBUG change or host-only firewall rule as patched-kernel acceptance. An interim packet filter must cover the relevant namespaces/traffic paths and be independently qualified; such a mitigation is not supplied or claimed by these kernel-package checks.

The Go Security Team explicitly supports GODEBUG=multipathtcp=0 only as a fragile, program-scoped reduction of the demonstrated MPTCP exposure. Explicit SetMultipathTCP(true) overrides it, other processes/namespaces are unaffected, and ordinary IPv4 TCP remains in the underlying bug's scope. This cannot satisfy the Pi/kernel gate. Through the lead, the Tailscale lane must verify the actual shipped binary's toolchain, socket configuration and effective listener protocol, including after service recreation; an environment string alone is not a test.

No authoritative complete Pi fallback or fixed vendor binary has been qualified here. Pi release acceptance remains blocked pending vendor-signed package/source patch evidence, exact firmware/boot selection and hardware reboot acceptance. Do not silently replace the vendor kernel or label an untested IP-options filter as supported mitigation. Qualification of any proposed packet-filter fallback must first cite vendor/upstream guidance, then demonstrate both plain TCP and MPTCP option-bearing traffic, local/loopback traffic, forwarded/container traffic, tunnels/decapsulation and newly created namespaces, with counters and a normal traffic control. The Go guidance does not establish that broader protection.