cve-2026-98432 (linux behind opnsense fw)

[paepcke]

https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf

- does not impact FreeBSD
- does impact every Linux behind your (OPNSense-) Firewall that accepts TCP packets

Is there away to identify and drop all impacted packets? With nft i can do ...

nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop


From my understanding:
- pf scrub does not care for tcp (options)
- pf is not able to identify tcp options
- ipfw can (but only well known specific, but can not scrub unknown? maybe by tcp header lenght?)
- firewall chaining is not recommended
- firewall chaining is not part of opnsense (but can be done via script manually)

Any other options/ ideas ? (other than chain/migrate to nft based firewall or dump the complete traffic through ids / suricate screen? )

[Monviech (Cedrik)]

PF has an allow-opts filter-rule modifier. By default, PF blocks packets containing IPv4 options. A pass rule needs allow-opts to permit them.

If you check your ruleset in /tmp/rules.debug you can grep if your ruleset contains rules with allow-opts.

Also if its on a non quick automatic rule that would allow-opts, you can create a quick rule in the same direction that blocks options.

https://docs.opnsense.org/manual/firewall.html#settings

Check the filter tab, its available (advanced setting)

[pfry]

Huh! I'd assumed they were looking at the TCP header Data Offset field (possible using netfilter) - I didn't look closely at the CVE. Makes it easy to filter (as I've always done by default).

For folks like me who sit in the GUI and are too lazy to grep, "Firewall: Diagnostics: Statistics": -> "rules", expand the rulesets, CTRL-f "opts". Should be one: "let out anything from firewall host itself".

[nero355]

PF has an allow-opts filter-rule modifier. By default, PF blocks packets containing IPv4 options. A pass rule needs allow-opts to permit them.

If you check your ruleset in /tmp/rules.debug you can grep if your ruleset contains rules with allow-opts.

Also if its on a non quick automatic rule that would allow-opts, you can create a quick rule in the same direction that blocks options.

So as long as you haven't created any Manual Firewall Rules that Allow TCP traffic to have 'allow-opts' included then even outdated Linux based devices are completely safe behind your OPNsense/FreeBSD based Firewall ?

If so : VERY COOL! :)