Mitigation for CVE-2026-98432 in OpenShift Cloud Services (ROSA, OSD and ARO)

Resolution

1. For ROSA, ARO and OSD Customer Cloud Subscription (CCS)

   • Control Plane Nodes: A mitigation will be applied by Red Hat without impacting the availability of the control plane. No customer action is required.
     • Note: In ARO this will entail a rolling reboot of control plane nodes but there should be no impact to control plane availability
   • Worker and Infrastructure Nodes: Customers may apply the mitigation steps described below for their worker and infrastructure nodes.

2. OSD Classic (non-CCS):

   • For standard OSD Classic non-CCS environments (infrastructure bundled along with OSD subscriptions), customers may open a support case to request the remediation of this vulnerability prior to the release of the OpenShift update containing the fix.

Note: This is an interim risk-reduction measure, not a complete fix for the vulnerability. Install the fixed kernel through a supported OpenShift update when it becomes available. For more details, refer to the RHSB-2026-016 Security Bulletin.

The mitigation is based on an nftables rule that filters incoming IPv4 TCP packets containing IP options as a temporary measure to reduce exposure to CVE-2026-98432. Standard application traffic is generally expected to remain unaffected. However, workloads or network configurations that rely on IPv4 options, including certain CIPSO/NetLabel configurations, may experience connectivity issues or service disruptions.

• Review the rule against your network configuration and workload requirements.
• Test the mitigation in a non-production environment before applying it to production.

Mitigation using privileged DaemonSet

ROSA Classic, ROSA HCP, and OSD CCS

Create the namespace, ServiceAccount, RoleBinding, ConfigMap and DaemonSet:

--- # Namespace
apiVersion: v1
kind: Namespace
metadata:
  name: cve-2026-98432-user-mitigation
--- # ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nftables-mitigation
  namespace: cve-2026-98432-user-mitigation
--- # RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: system:openshift:scc:privileged
  namespace: cve-2026-98432-user-mitigation
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:privileged
subjects:
  - kind: ServiceAccount
    name: nftables-mitigation
    namespace: cve-2026-98432-user-mitigation
--- # ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: nftables-rules
  namespace: cve-2026-98432-user-mitigation
data:
  cve-2026-98432.nft: |
   table inet cve_2026_98432
   delete table inet cve_2026_98432
   table inet cve_2026_98432 {
       chain input {
           type filter hook input priority -310; policy accept;
           ip protocol tcp ip hdrlength > 5 counter drop
       }
   }
--- # DaemonSet
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: nftables-mitigation
  namespace: cve-2026-98432-user-mitigation
spec:
  selector:
    matchLabels:
      app: nftables-mitigation
  template:
    metadata:
      labels:
        app: nftables-mitigation
    spec: 
      serviceAccountName: nftables-mitigation
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        kubernetes.io/os: linux
        node-role.kubernetes.io/worker: ""
      tolerations:
        - operator: Exists
      containers:
        - name: nftables
          image: registry.redhat.io/ubi9/ubi-minimal:9.8
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
          command: ["/bin/sh", "-ec"]
          args:
            - |
              microdnf install -y nftables
              nft -f /etc/cve-2026-98432/cve-2026-98432.nft
              exec sleep infinity
          readinessProbe:
            exec:
              command:
                - /bin/sh
                - -ec
                - nft list chain inet cve_2026_98432 input | grep -q 'hdrlength'
            periodSeconds: 10
          volumeMounts:
            - name: nftables-rules
              mountPath: /etc/cve-2026-98432
              readOnly: true
          lifecycle:
            preStop:
              exec:
                command: ["nft", "delete", "table", "inet", "cve_2026_98432"]
      volumes:
        - name: nftables-rules
          configMap:
            name: nftables-rules

Note: Clusters configured with Zero-Egress in “lockdown” will not be able to use microdnf to install nftables within the ubi-minimal:9.8 image. For these clusters, the mitigation instructions are captured in a separate knowledgebase article. Zero-Egress clusters not in “lockdown” can use this YAML set without issue.

ARO Standard and ARO Hosted Control Plane

Create the namespace, ServiceAccount, RoleBinding, ConfigMap and DaemonSet. Replace the placeholder in the YAML below with the correct image for your ARO variant.

• ARO Standard architecture in public regions: arosvc.azurecr.io/ubi9/ubi-minimal
• ARO Standard architecture in Microsoft Azure Government regions: arosvc.azurecr.us/ubi9/ubi-minimal
• ARO HCP: image-registry.openshift-image-registry.svc:5000/openshift/tools:latest

--- # Namespace
apiVersion: v1
kind: Namespace
metadata:
  name: cve-2026-98432-user-mitigation
--- # ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nftables-mitigation
  namespace: cve-2026-98432-user-mitigation
--- # RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: system:openshift:scc:privileged
  namespace: cve-2026-98432-user-mitigation
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:privileged
subjects:
  - kind: ServiceAccount
    name: nftables-mitigation
    namespace: cve-2026-98432-user-mitigation
--- # ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: nftables-rules
  namespace: cve-2026-98432-user-mitigation
data:
  cve-2026-98432.nft: |
   table inet cve_2026_98432
   delete table inet cve_2026_98432
   table inet cve_2026_98432 {
       chain input {
           type filter hook input priority -310; policy accept;
           ip protocol tcp ip hdrlength > 5 counter drop
       }
   }
--- # DaemonSet
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: nftables-mitigation
  namespace: cve-2026-98432-user-mitigation
spec:
  selector:
    matchLabels:
      app: nftables-mitigation
  template:
    metadata:
      labels:
        app: nftables-mitigation
    spec:
      serviceAccountName: nftables-mitigation
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        kubernetes.io/os: linux
        node-role.kubernetes.io/worker: ""
      tolerations:
        - operator: Exists
      containers:
        - name: nftables
          image: <IMAGE>
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
          command: ["/bin/sh", "-ec"]
          args:
            - |
              microdnf install -y nftables
              nft -f /etc/cve-2026-98432/cve-2026-98432.nft
              exec sleep infinity
          readinessProbe:
            exec:
              command:
                - /bin/sh
                - -ec
                - nft list chain inet cve_2026_98432 input | grep -q 'hdrlength'
            periodSeconds: 10
          volumeMounts:
            - name: nftables-rules
              mountPath: /etc/cve-2026-98432
              readOnly: true
          lifecycle:
            preStop:
              exec:
                command: ["nft", "delete", "table", "inet", "cve_2026_98432"]
      volumes:
        - name: nftables-rules
          configMap:
            name: nftables-rules

Verification

oc -n cve-2026-98432-user-mitigation get daemonset,pods -o wide

ok=0; total=0
for node in $(oc get nodes -l node-role.kubernetes.io/worker -o name); do
  total=$((total+1))
  oc debug "$node" -- chroot /host nft list chain inet cve_2026_98432 input | grep -q 'hdrlength > 5' && ok=$((ok+1))
done
echo "$ok/$total nodes have the rule installed"

Additionally, you can run the following python script from either from an authorized test host on a network path that permits IPv4 options or from another node in the cluster to reach the target node. Identify a source node and a target node IP first:

oc debug node/$SOURCE_NODE -- chroot /host python3 -c '
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(2)
s.setsockopt(socket.IPPROTO_IP, socket.IP_OPTIONS,
             bytes([7, 39, 4]) + bytes(37))  # IPv4 Record Route
try:
    s.connect(("$TARGET_NODE_IP", 10250))
except (socket.timeout, OSError):
    print("Connection blocked (nftables rule is working)")
    pass
finally:
    s.close()
'

Then inspect the counter on the target node:

oc debug node/NODE_NAME -- chroot /host nft list chain inet cve_2026_98432 input

Example output after the probe:

[core@nodename ~]$ sudo nft list chain inet cve_2026_98432 input
table inet cve_2026_98432 {
    chain input {
        type filter hook input priority raw - 10; policy accept;
        ip protocol tcp ip hdrlength > 5 counter packets 1 bytes 80 drop
    }
}

The probe is a TCP SYN with an IPv4 Record Route option. Nping may report no reply (Rcvd: 0, Lost: 100%); this alone does not prove the node dropped it, because another network device might have discarded it. Confirm the rule counter increased on the target node.

The rule's counter packets and bytes values are cumulative since the table was loaded or the counter was reset. In the example, a change from 0 packets 0 bytes to 1 packet 80 bytes means one matching 80-byte IP packet reached the rule and was dropped. The 80 bytes match Nping's reported packet size. If the counter remains unchanged, the packet might not have reached this node or might not have matched the rule.

Removal

Once the kernel fix is available through a supported OpenShift update, update your cluster and remove the mitigation. In order to remove the mitigation, first delete the DaemonSet so it no longer reapplies the rule. The table will automatically be removed by the lifecycle prestop hook:

oc delete daemonset nftables-mitigation -n cve-2026-98432-user-mitigation

Verify the table is absent on every target node, then remove the ConfigMap, RoleBinding, ServiceAccount, and namespace.

You can safely remove rest of the resources applied for the mitigation

oc delete serviceaccount nftables-mitigation -n cve-2026-98432-user-mitigation
oc delete configmap nftables-rules -n cve-2026-98432-user-mitigation
oc delete rolebindings system:openshift:scc:privileged -n cve-2026-98432-user-mitigation
oc delete namespace cve-2026-98432-user-mitigation

For more Information:

• RHSB-2026-016
• For self-managed OpenShift Container Platform 4, refer to KCS 7149635
• For ROSA HCP clusters configured with Zero-Egress, refer to KCS 7149742
• Custom nftables firewall rules in OpenShift
• Open a support case with Red Hat Technical Support