Hacker News Reader

Comment by ay | Hacker News Reader

Just block the ingress IPv4 packets with IP options using nftables or iptables and move on.

Why does everything has to come with so much drama these days.

Red Hat claims[1] that's not enough:

> The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it.

I suppose locally-running malicious programs could send packets to the loopback address or one of its own IPs or something.

[1] https://access.redhat.com/security/vulnerabilities/RHSB-2026...

eBPF programs can also bypass netfilter, as can different network namespaces (like as used by containers and some privsep/isolated software).

locally-running malicious programs

That's Game Over already.

It could be from a multi-part attack where someone combines an application-level RCE like php2shell, then sends the evil loopback packets to elevate to root.

if people decide so, certainly

I know that's one mitigation technique, like disabling mptcp does. But does that fully prevent this exploit?

The thing that is freed and then used-after-free in case the exploit is due to the data structure temporarily storing IP options from the original packet.

Thanks. Red Hat's claim that blocking IPv4 options wasn't enough made me think a larger structure was used-after-free.

I made my hungry ghosts in a jar do a couple of detailed code walkthroughs which are captured in the link below.

trigger warning: text fully written by hungry ghosts, I only had them apply 100+ item checklists to make it hopefully more readable.

i suspect RH might have indeed covering the loopback case… or, just hedging in general - glass houses and all that…

Hope this helps.

https://ayourtch-llm.github.io/apchat-blog/posts/2026-11-02-...

P.s. I now realize having stared at the code a bit has put me into the “so what ?” mode, which evidently wasn’t compatible with the prevailing sentiment among folks that used only the advisories :-) sorry to all who I got upset.

Nice analysis. That helps clarify how mptcp is involved. At first I thought your response was total nonsense because I have no idea what "hungry ghosts" have to do with anything.

Yeah I immediately got curious “why ip options if it’s TCP and what does it have to do with multipath”, this was pretty calming - and since i am always paranoid about provenance, everything of consequence has a backlink to verify it’s not a glitch.

And sorry for the slang :-) “hungry ghosts in a jar” is much more fun than “LLM agents”

Reply on news.ycombinator.com