A severe vulnerability in the Linux kernel's TCP handshake, CVE-2026-98432, was disclosed this week. It can be triggered before TLS or any authentication runs, so it affects any machine that accepts TCP connections. That includes every Linux node that runs Tuist services.
We prioritized this work as soon as the vulnerability was disclosed. We mitigated it across our production infrastructure on the same day, with no downtime and no action needed from you.
What we did
- Reduced network exposure. We audited which ports our nodes accept from the internet and closed internal endpoints that only need to be reachable from inside the cluster.
- Patched our management cluster. We moved it to a Talos release with a kernel that includes the fix, upgrading one control-plane node at a time.
- Blocked the attack path on every Linux node. The exploit depends on IPv4 TCP packets that carry IP options, which legitimate traffic almost never uses. We now drop those packets at the node before they reach the kernel's TCP stack.
- Disabled multipath TCP (MPTCP). The known exploit needs an MPTCP listener, so we turned MPTCP off on all managed Linux nodes, including our cache nodes.
What's next
Our Linux nodes run Ubuntu 24.04, and Canonical hasn't released a fixed kernel yet. When it does, we'll roll it out in order of risk, starting with the Linux runners that execute customer CI workloads. Rollouts will happen one node or region at a time to avoid disruption. Until then, the mitigations above stay in place.
macOS hosts don't run Linux, so they aren't affected.
If you have questions about how this affects your organization, contact us at [email protected].