protocol.be

sysctl:
sudo sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled=0" | sudo tee /etc/sysctl.d/99-disable-mptcp.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-disable-userns.conf

fw:
sudo nft add table inet cve_2026_98432
sudo nft add chain inet cve_2026_98432 input { type filter hook input priority -310\; policy accept\; }
sudo nft add rule inet cve_2026_98432 input ip protocol tcp ip hdrlength > 5 counter drop comment \"CVE-2026-98432\"

iptables -t raw -I PREROUTING -p tcp -m u32 --u32 "0>>24&0xF=6:15" -m comment --comment "CVE-2026-98432" -j DROP

ip protocol tcp ip hdrlength > 5 counter drop comment "CVE-2026-98432"

sudo sysctl -w net.mptcp.enabled=0

echo "net.mptcp.enabled=0" | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

sudo ss -lnMp

sudo sysctl -w kernel.unprivileged_userns_clone=0

echo -e "blacklist esp4\nblacklist esp6\nblacklist rxrpc\nblacklist ip6_tunnel" | sudo tee /etc/modprobe.d/disable-frag-CVEs.conf