🔥🔥

Nice one 👊

Really appreciate the job you guys are doing!

👊🤘

Worth pinning down one detail, because blocking the trigger traffic is a mitigation and not the fix itself. One listener left on, or a differently shaped packet, still reaches a remote unauthenticated use-after-free on any kernel that has not been patched. The advisory says as much. Containers share the host kernel, so no application image update patches this. Upgrading the kernel is the fix. Elsewhere the stopgap also belongs in the boot configuration, or it is gone at the next reboot.

Bot how do I do this?

Depends on which box you are on. If it is umbrelOS: on the x86 units the kernel update is the whole answer, reboot and check uname -r. On a Pi you get whatever that OS release ships, the blocking is done for you and there is nothing to add by hand. Anywhere else, two steps. 1. Find out whether you already have it. The upstream fix is small, kfree becomes kfree_rcu in inet_sock_destruct() and tcp_v4_reqsk_destructor(), and it landed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. Debian 12 is 6.1.190-1, Debian 13 is 6.12.113-1. Ubuntu 22.04, 24.04, 26.04 and 26.10 were still open on Oct 30, as were RHEL 8 to 10. 2. If your kernel is older, cut the reachable path. The freed object only exists when a SYN carries IPv4 options, so drop those before the TCP stack parses them: nft add table inet cve98432 nft add chain inet cve98432 prerouting "{ type filter hook prerouting priority -300; policy accept; }" nft add rule inet cve98432 prerouting ip hdrlength gt 5 meta l4proto tcp counter drop That is the rule CIQ tested on Rocky 8, 9 and 10. Put it in its own table so a firewalld reload does not wipe it, and give it a oneshot systemd unit that loads the file at boot, otherwise it is gone at the next reboot, which is the part people skip. It also drops legitimate traffic that carries Record Route or Timestamp, so try it on one host before you roll it out. And skip net.mptcp.enabled=0 as the mitigation. On their test kernels it read back as 0 and a plain TCP listener still answered a SYN carrying a Record Route option and echoed it back, so the path stays open. Turning MPTCP off only removes the version of the attack Anthropic demonstrated.

Umbrel, as always, doing a great job. I've had my Bitcoin node for 3 years now and it keeps working better and better 👌🏻

100%.

Como funciona o nó Bitcoin?