Top
Best
New

Posted by oger 7 hours ago

TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8(atlasum.net)
337 points | 160 commentspage 4
dofm 4 hours ago|
[06:00]
ogogmad 6 hours ago||
How are people finding Fil-C? It's designed to avoid things like this.
_flux 5 hours ago||
It might be bit of an effort to get Fil-C compiling the Linux kernel. As I understand it, it would amount to running garbage collector in the kernel, so some care would probably need to be taken to ensure it doesn't stop things at the wrong time, e.g. interrupts.
cowlevel 5 hours ago||
Does it support writing kernels?
TacticalCoder 3 hours ago||
Let me guess... The bug is in C code?

(reading TFA)

    net/ipv4/af_inet.c
    net/ipv4/tcp_ipv4.c
Ah yup.

And moreover it's a security issue found by LLMs.

It's kinda a really bad time to be a C-loving, AI-hating, fanboi.

Do we at least entertain the idea that some rewrites of some things in safer languages could be a desirable goal? (not saying it's practical or not: just asking if C lovers are willing to reflect a bit on what's going on atm).

secondcoming 3 hours ago||
Get rewriting, soldier!
TZubiri 3 hours ago||
maybe

i’d focus on writing new stuff with rust though, not rewriting old stuff

and time will tell whether it actually reduces bugs or just change the failure modes to something else

also C will always be there in some way or the other, at least in conventions and syntax

grommz 3 hours ago||
Who wrote the bug? Very likely someone at Redhat.
jck86 4 hours ago||
Finally a usecase for mptcp on linux. Been waiting and trying off and on for years to get it to do something, but now it can give a nice remote root shell. Well, not to me, I just get to patch devices.
rurban 5 hours ago|
In an earlier report, it said only affected is kernel 4.4, not all since. This quite dramatic now.

I see. https://nvd.nist.gov/vuln/detail/cve-2026-98432 affected versions format is the culprit. Entirely unusable. We do have versions, branch names and tags for a reason.

pizza234 5 hours ago|
Wrong. Every kernel from 4.4 onward is affected until the fixed releases (5.10.272, 5.15.223, 6.1.190 and so on).
Mawr 3 hours ago||
Right. The "Affected Products" section on https://nvd.nist.gov is absolutely useless and highly misleading. I don't understand how this can be the case for something so security critical.