Impact of CVE-2026-98432 on VMware Ubuntu Jammy BOSH Stemcell and Bitnami Base images
Article ID: 461242
Updated On:
Products
Issue/Introduction
A critical vulnerability in the Linux kernel's TCP code (identified as CVE-2026-98432) was discovered and rated CVSSv3 (Common Vulnerability Scoring System) 9.8. The vulnerability is in the Linux kernel's IPv4 TCP connection handling code and is a race condition that allows an unauthenticated remote attacker to execute commands as root on servers utilizing multipath TCP (MPTCP) listeners.
VM-based components in Tanzu Platform – BOSH Stemcells, Foundation Core Appliance (Operations Manager), TKGIMC, Tanzu Hub OVA Installer– are affected by this issue. Unless blocked or dropped, specifically crafted TCP traffic against a listening service inside of Tanzu Platform can cause it to crash. While all services in Tanzu Platform are restarted automatically, frequent restarts will result in a complete Denial of Service (DoS) for parts of the platform and/or applications running on the platform.
Bitnami VM images and the TrueSource hub OVA installer are also impacted in a similar way.
Resolution
Tanzu Platform
Tanzu is working on patching the linux BOSH Stemcells and Foundation Core Appliance, pending a release from Canonical.
In the meantime we highly recommend customers use their network firewalls to drop this type of traffic before it reaches any VMs. If this is not possible externally, there is an iptables command that can be run manually on BOSH-deployed VMs to drop this traffic as well, which will not survive when the VM is restarted. There is also the option to install the iptables rule using os-conf bosh addon which will persist the changes upon vm restarts or recreates.
Warning: this will drop all traffic with this IPv4 TCP option enabled, including communication that is not part of an attack!
Workaround 1 - Manually set iptables rules
This procedure will NOT allow iptables rule setting to persist during reboots and recreates.
- Identify deployments you want to protect
$ bosh deps --column=name Using environment 'X.X.X.X' as client 'ops_manager' Name cf-GUID
- List instances in the deployment you want to apply the rule on
bosh -d cf-GUID instances
- Run the following command to apply the iptables rule to all vms for a given instance. In this example we applied the rule to all uaa vms in the cf deployment
bosh -d cf-GUID ssh uaa -c 'sudo /usr/sbin/iptables -t raw -I PREROUTING -p tcp -m u32 --u32 "0>>24&0xF=6:15" -m comment --comment CVE-2026-98432 -j DROP'
- BOSH will print “Succeeded” when done
How to delete the iptables rule after using the manual procedure
bosh -d cf-GUID ssh uaa -c 'sudo /usr/sbin/iptables -t raw -D PREROUTING -p tcp -m u32 --u32 "0>>24&0xF=6:15" -m comment --comment CVE-2026-98432 -j DROP'
Workaround 2 -
This procedure will allow iptables rule setting to persist during reboots and recreates. Please note placement rules for BOSH add-ons are documented here and should be adjusted to meet your needs. The example below shows how to include specific deployments such as the cf deployment. Some other use cases could be as followed
- Change “include” to “exclude” to install this add-on to all tiles except for the ones specified.
- Remove the “include” object from the configuration entirely to have the add-on installed on all BOSH deployed VMs.
Procedure to update pre-start-script job in os-conf to apply iptables mitigation
- upload os-conf release v23.0.4 to your bosh director. The upload command is available in the provided link
- create a runtime configuration file called os-conf-CVE-2026-98432.yml with the following contents. Make sure to edit the include.deployments section to include the deployment names you want the iptables rule to apply to
releases: - name: os-conf version: 23.0.4 addons: - name: os-configuration include: deployments: - cf-GUID jobs: - name: pre-start-script release: os-conf properties: script: |- #!/bin/bash set -e if [ -f "/etc/iptables.rules" ]; then if [ -f "/etc/systemd/system/restore-iptables.service" ]; then echo "iptables rule for CVE-2026-98432 already installed. you must recreate vm to re-install iptables rule" echo "restarting restore-iptables service" systemctl restart restore-iptables.service exit 0 fi fi cat << EOF > /etc/systemd/system/restore-iptables.service [Unit] Description=Restore iptables rules on boot After=network.target [Service] Type=oneshot ExecStart=/bin/sh -c '/sbin/iptables-restore < /etc/iptables.rules' RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF cat << EOF > /etc/iptables.rules # Generated by iptables-save v1.8.7 on Fri Oct 30 20:09:41 2026 # Completed on Fri Oct 30 20:09:41 2026 # Generated by iptables-save v1.8.7 on Fri Oct 30 20:09:41 2026 *raw :PREROUTING ACCEPT [63562:68321456] :OUTPUT ACCEPT [80028:96676178] -A PREROUTING -p tcp -m u32 --u32 "0x0>>0x18&0xf=0x6:0xf" -m comment --comment CVE-2026-98432 -j DROP COMMIT # Completed on Fri Oct 30 20:09:41 2026 EOF systemctl daemon-reload systemctl enable restore-iptables.service systemctl restart restore-iptables.service
- deploy the os-conf-CVE-2026-98432.yml as a runtime config using bosh cli
bosh update-config --name CVE-2026-98432 --type runtime os-conf-CVE-2026-98432.yml
- apply changes through Operations Manager or run deployments manually as per below
bosh -d cf-GUID manifest > cf-GUID-manifest.yml bosh -d cf-GUID deploy cf-GUID-manifest.yml
How to Rollback the os-conf changes
Run these steps if you wish to remove the iptables rules when the os-conf method was used
bosh delete-config --type runtime --name CVE-2026-98432
bosh -d cf-GUID recreate
How to validate a VM has the rule in place
- The output for the raw table should match below.
~# iptables -L -t raw Chain PREROUTING (policy ACCEPT) target prot opt source destination DROP tcp -- anywhere anywhere u32 "0x0>>0x18&0xf=0x6:0xf" /* CVE-2026-98432 */ Chain OUTPUT (policy ACCEPT) target prot opt source destination
Bitnami
Patched Bitnami images have already been released. Please upgrade impacted deployments immediately.
Feedback
