Hacker News
points by jakobdabo 12 hours ago | 0 comments
> the attacker chained in a second exploit: a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem

Linux seems to have a huge attack surface that doesn't necessarily need to be there for every user/server.

E.g. this came out today: CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation [1].

I just disabled mptcp on my systems since I don't use it. Why was it enabled by default?

Can I disable this XFRM thing too?

[1] https://www.penligent.ai/hackinglabs/cve-2026-98432/

[–] jjmarr 3 hours ago
I'm on Gentoo and when I compile my kernel, by default, almost nothing is enabled.

On other distros they throw in the kitchen sink because it is easier than making an endless amount of them customized to every system.

[–] codedokode 4 hours ago
On Android many things available on Desktop Linux are disabled by selinux. For example, af_alg algorithm (encryption kernel module writes out of bounds) is not accessible by user using ADB.
[–] daymanstep 12 hours ago
The bug doesn't mention MPTCP, is MPTCP required for the bug to be exploitable?
[–] dboreham 10 hours ago
No, but MPTCP makes it more likely to be exploited, supposedly.
[–] anthk 9 hours ago
SMB in the kernel and binding io_uring to DMABUF doesn't look pretty safe either.

Torvalds needs to borrow Rust code from Asterinas (and maybe Redox) ASAP.

[–] robwayne 7 hours ago
> Linux seems to have a huge attack surface that doesn't necessarily need to be there for every user/server.

IIRC it was CVE-2026-31431 earlier this year that made me go audit what modules were loaded and go on a whole hardening kick. As far as I understood, the vulnerable module (algif_aead) wasn't even commonly used by anything.

So why is it loaded by default? It's just an extra code path to potentially exploit my system with. It's even marked deprecated (and insecure!), yet a fresh NixOS (and Arch, I believe) install has it loaded out of the box.

I mean, I get it, broad compatibility and all that jazz... but still.

[–] cowlevel 6 hours ago
The XFRM thing is probably Dirty Frag, patched several months ago.
[–] 0xbadcafebee 5 hours ago
Everything is enabled by default in Linux, it's just their way. Privilege escalation exploits for Linux are found every year. If you can RCE a Linux box, assume you can also get root.