# TCP options mitigation

Ubuntu still lists CVE-2026-98432 as vulnerable on Noble on 2026-11-04:
https://ubuntu.com/security/CVE-2026-98432.
MPTCP stays disabled; disabling it alone does not eliminate this TCP race.

The dedicated nftables table drops IPv4 TCP packets carrying **IP options**.
Ordinary TCP options (timestamps, window scaling), IPv6, and existing firewall
policy are unaffected. Connections requiring IPv4 options will fail. This is
risk reduction, not a substitute for the fixed kernel.

The prerouting hook covers external traffic before Docker DNAT/forwarding;
the output hook also covers host-originated traffic. Separate container network
namespaces can still generate internal traffic outside these hooks. Do not
claim protection against untrusted local/container workloads.

Install the nft file as `/etc/stream-tcp-options-guard.nft` and the unit in
`/etc/systemd/system/`. Run `nft -c -f /etc/stream-tcp-options-guard.nft`, then
`systemctl daemon-reload` and `systemctl enable --now stream-tcp-options-guard`.
The unit owns only its named table. Do not enable the default nftables service
or flush the ruleset: Docker owns other tables.

Verify with `nft list table inet stream_tcp_options_guard`, a fresh SSH session,
HTTPS health/status checks, and advancing upstream sequences. Roll back with
`systemctl disable --now stream-tcp-options-guard`. Keep the mitigation until a
fixed Ubuntu kernel is available, installed, booted, and verified with `uname -r`.

## MPTCP namespaces

`net.mptcp.enabled` is per network namespace. Verify it inside each container;
the host value alone does not prove container state. Include
`deploy/security/compose.mptcp.yaml` in the deployment's `COMPOSE_FILE` list
so both Stream and Caddy keep MPTCP disabled after recreation.

For a running container, its namespace can be updated without a restart:

```sh
stream_pid=$(docker inspect stream-experiment-stream-1 --format '{{.State.Pid}}')
nsenter -t "$stream_pid" -n sysctl -w net.mptcp.enabled=0
docker exec stream-experiment-stream-1 cat /proc/sys/net/mptcp/enabled
```

This is an additional reduction in exposure, not a replacement for the filter
or the patched kernel. The host's `/etc/sysctl.d/99-disable-mptcp.conf` remains
in place as well.