Linux TCP use-after-free CVE-2026-98432 mitigation on OpenWRT

The latest OpenWRT as of writing is 25.12.6 that ships with Linux 6.12.112, thus vulnerable to CVE-2026-98432 fixed in Linux 6.12.113.

While waiting for 25.12.7, the vulnerability can be mitigated by configuring fw4 to drop IPv4 packets with Options header and then disable MPTCP. Both mitigations have to be applied to be effective.

Drop IPv4 packets with Options header
Disable MPTCP

Drop IPv4 packets with Options header §

Create a file in “/etc/custom-scripts/drop-ipv4-options.nft” or whichever preferred folder, as long as the folder is included in “/etc/sysupgrade.conf”. The firewall rule can stay permanently as normal traffic almost never uses IPv4 options.

# https://almalinux.org/blog/2026-10-30-cve-2026-98432/#temporary-mitigation-if-you-cannot-reboot-yet
chain drop_ipv4_options {
  type filter hook prerouting priority -300; policy accept;
  meta l4proto tcp ip hdrlength > 5 counter drop comment "!fw4: Drop IPv4 packets with Options header CVE-2026-98432"
}

Existing raw_prerouting chain has similar hook and priority, but it doesn’t support include.

Append to “/etc/config/firewall”,

config include
  option type 'nftables'
  option position 'table-post'
  option path '/etc/custom-scripts/drop-ipv4-options.nft'

Then reload fw4.

/etc/init.d/firewall reload

LuCI web > Status > Firewall (“/admin/status/nftables”) > Traffic filter chain “drop_ipv4_options”

Rule matches	Rule actions
# 0 B IP protocol is TCP ip.hdrlength greater than 5	Drop packet

Disable MPTCP §

MPTCP is enabled by default, at least on my devices.

root@OpenWRT:~# sysctl net.mptcp.enabled
net.mptcp.enabled = 1

If MPTCP is not used, disable it and keep it disabled across reboots.

sysctl -w net.mptcp.enabled=0
printf '# https://almalinux.org/blog/2026-10-30-cve-2026-98432/#temporary-mitigation-if-you-cannot-reboot-yet
\nnet.mptcp.enabled = 0\n' > /etc/sysctl.d/90-disable-mptcp_cve-2026-98432.conf

root@OpenWRT:~# sysctl net.mptcp.enabled
net.mptcp.enabled = 0

The config may not survive sysupgrade, so MPTCP might be re-enabled after upgrading to 25.12.7 which is fine as the vulnerability would’ve been fixed by then.

If you prefer MPTCP to be permanently disabled, append to “/etc/sysctl.conf” instead.

Credit: almalinux.org