cve-2026-98432 (linux behind opnsense fw)

[paepcke]

https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf

- does not impact FreeBSD
- does impact every Linux behind your (OPNSense-) Firewall that accepts TCP packets

Is there away to identify and drop all impacted packets? With nft i can do ...

nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop


From my understanding:
- pf scrub does not care for tcp (options)
- pf is not able to identify tcp options
- ipfw can (but only well known specific, but can not scrub unknown? maybe by tcp header lenght?)
- firewall chaining is not recommended
- firewall chaining is not part of opnsense (but can be done via script manually)

Any other options/ ideas ? (other than chain/migrate to nft based firewall or dump the complete traffic through ids / suricate screen? )