News for hackers. Stuff that matters.

A comment on Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks.

Re:Ubuntu still has not released patch for Linux 0day RCE in... by ay on Monday November 02, 2026 @05:28PM (#50344886)
Just block the ingress IPv4 packets with IP options using nftables or iptables and move on.

Why does everything has to come with so much drama these days.

[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by cpburns2009 on Monday November 02, 2026 @07:28PM (#50346317)
I know that's one mitigation technique, like disabling mptcp does. But does that fully prevent this exploit?
[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by majorchord on Monday November 02, 2026 @07:30PM (#50346333)
Red Hat claims[1] that's not enough:

> The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it.

I suppose locally-running malicious programs could send packets to the loopback address or one of its own IPs or something.

[1] https://access.redhat.com/security/vulnerabilities/RHSB-2026...

[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by userbinator on Monday November 02, 2026 @10:37PM (#50347744)
locally-running malicious programs

That's Game Over already.

[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by ranger_danger on Monday November 02, 2026 @11:07PM (#50347940)
It could be from a multi-part attack where someone combines an application-level RCE like php2shell, then sends the evil loopback packets to elevate to root.
[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by perching_aix on Monday November 02, 2026 @11:59PM (#50348268)
[delayed]
[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by ranger_danger on Monday November 02, 2026 @11:04PM (#50347913)
eBPF programs can also bypass netfilter, as can different network namespaces (like as used by containers and some privsep/isolated software).
[ Parent | on HN ]