A CVE-2026-98432 firewall rule for Ubuntu, with or without Docker
Comments on “A CVE-2026-98432 firewall rule for Ubuntu, with or without Docker”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
PhotoStructure published a temporary nftables mitigation for CVE-2026-98432, a kernel use-after-free involving IPv4 TCP packets with IP options, which Ubuntu rates High; its 26.04 fix was still in progress as of November 1. The author says Red Hat's input-hook rule and a UFW one-liner miss traffic forwarded to Docker bridge containers, while a prerouting and output table catches it. Testing covered only Ubuntu 26.04, verified packet filtering rather than exploit resistance, and the rule needs Ubuntu 24.04 or later. It does not replace a patched kernel.
Why it ranked
No. 8 of 107 with a score of 0.70. The panel rated it highest on technical depth (0.91) and substantiated (0.88), lowest on new information (0.44). The judges disagreed most on new information (spread 0.57), so the story is marked contested. Placed No. 8, No. 7 by score alone: the fifth Security story of the day (−0.040). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Practical, well-tested mitigation guidance for a serious kernel use-after-free, with specific rules, limits and test methodology. Important mainly to sysadmins and ops; narrower than a landmark and the vulnerability itself is already covered in the week's stories.
- AI judgeJudge 3gpt-5.6-luna
- A highly practical, technically detailed mitigation with tested nftables, UFW, Docker, namespace, rollback, and validation guidance. Its core CVE is already covered, reducing novelty, but the implementation details are strongly useful to operators and infrastructure builders.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.70total under rubric v2.3Contestedjudges differ by 0.57 on new information
- Significance0.61
- Reader interest0.75
- Audience breadth0.61
- Practical relevance0.85
- Substantiated0.88
- Technical depth0.91
- New information0.44
- Counts against: Promotional0.03
- Counts against: Overclaim0.11
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.57 | 0.55 | 0.72 | 0.61 | 0.17 | +0.24 | +0.147 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.64 | 0.72 | 0.90 | 0.75 | 0.26 | +0.26 | +0.196 |
| Audience breadthHow many people who build technology does it concern? | 0.61 | 0.60 | 0.62 | 0.61 | 0.02 | +0.13 | +0.079 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.80 | 0.85 | 0.90 | 0.85 | 0.10 | +0.22 | +0.187 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.90 | 0.80 | 0.93 | 0.88 | 0.13 | +0.05 | +0.044 |
| Technical depthHow technically substantive is it? | 1.00 | 0.85 | 0.88 | 0.91 | 0.15 | +0.05 | +0.045 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.77 | 0.20 | 0.35 | 0.44 | 0.57 , above the contested threshold | +0.05 | +0.022 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.03 | 0.01 | 0.03 | 0.03 | −0.19 | −0.005 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.16 | 0.12 | 0.04 | 0.11 | 0.12 | −0.11 | −0.012 |
| Sum of contributions | +0.704 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.704 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-03/8/"><img src="https://rubric.hrih.si/badge/2026-11-03/8.svg" alt="Ranked #8 on Rubric, 3 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 2 matches source · 3 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
CVE-2026-98432 is a use-after-free in the kernel's handling of IPv4 TCP connections with IP options.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “is a use-after-free in the kernel’s handling of IPv4 TCP connections with IP options”
The source says No passage could be compared.
Source cited by the article: ubuntu.com/security/CVE-2026-98432
Matches sourceVersion
Ubuntu rates CVE-2026-98432 High, and as of November 1, 2026 its tracker listed the Ubuntu 26.04 linux package as vulnerable, with a fix in progress for 7.0.0-43.43.
The cited source says the same thing.
The article says “Ubuntu rates it High; as of November 1, 2026, its tracker listed the Ubuntu 26.04 linux package as vulnerable, with a fix in progress for 7.0.0-43.43”
The source says “26.04 LTS resolute Vulnerable work in progress in 7.0.0-43.43”
Source cited by the article: ubuntu.com/security/CVE-2026-98432
Matches sourceQuote
Red Hat's advisory recommends a temporary nftables filter on the input hook that drops incoming IPv4 TCP packets with IP options.
The cited source says the same thing.
The article says “recommends a temporary filter that drops incoming IPv4 TCP packets with IP options, using an nftables rule on the input hook”
The source says “The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it”
Source cited by the article: access.redhat.com/security/vulnerabilities/RHSB-2026-016
Couldn’t checkQuote
Ubuntu says the main issue does not affect IPv6, but notes a separate request-socket migration issue involving CALIPSO options.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Ubuntu says the main issue doesn’t affect it, but notes a separate request-socket migration issue involving CALIPSO options”
The source says No passage could be compared.
Source cited by the article: ubuntu.com/security/CVE-2026-98432
No source givenVersion
The destroy table command requires nftables 1.0.7 and kernel 6.3 or later, so the table needs Ubuntu 24.04 or later; Ubuntu 22.04's nftables 1.0.2 rejects it with a syntax error.
The article gives no link or citation for it.
The article says “destroy table needs nftables 1.0.7 and kernel 6.3 or later, so the table needs Ubuntu 24.04 or later”
The source says No source to compare with.
No source givenGeneralization
Red Hat's input rule and the UFW one-liner miss traffic forwarded to a Docker bridge container's published port, while the prerouting rule drops it.
The article gives no link or citation for it.
The article says “Forwarded to a Docker bridge container’s published port misses it misses it drops”
The source says No source to compare with.
Couldn’t checkNumber
With the table loaded on Ubuntu 26.04, plain requests got HTTP 200 and every IP-options request was dropped, including after ufw reload, a Docker restart, and a reboot.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “plain requests got HTTP 200 responses and every options request was dropped, including after ufw reload, a Docker restart, and a reboot”
The source says No passage could be compared.
Source cited by the article: photostructure.com/coding/cve-2026-98432/runtest.sh
No source givenNumber
IP-options packets sent from outside (home and two other Hetzner servers) were dropped before reaching the target even with no rule loaded.
The article gives no link or citation for it.
The article says “Options packets we sent from outside, from home and from two other Hetzner servers, were dropped before they reached the target, even with no rule loaded”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 3 Nov 2026, 05:47 UTC. It played no part in the ranking.