If you run Linux, you might want to pay attention to CVE-2026-98432. This is a critical Linux vulnerability that could allow remote attackers to take control of affected systems, is raising an important question for manufacturers of connected devices and industrial equipment: How do you protect products when you don’t necessarily know what’s running inside them?
Joshua Marpet, Sr. Product Security Consultant, Finite State:
“This is a significantly bad problem. This is a problem effectively anybody could take control of a Linux system that’s affected by this. And of course, that’s horribly bad.
“Assume a system which is taking readings from a power plant. Now you can’t trust those readings. And you may not even know that.
“Assume a system that controls a power plant. Now that system could be under hostile control. And you may not even know that you’re vulnerable.
“Because unless a manufacturer is tracking all of the code that they’ve ever written, and all of the versions of the firmware that they’ve ever written, with proper software bills of materials (SBOMs), and proper cryptographic bills of materials (CBOMs), and they’re tracking all of the potential threats and vulnerabilities (threat intelligence), they may never hear about the vulnerability, and they may never be able to tie the vulnerability to an older version of firmware that 100s of clients may still be running.
“And remember a manufacturer doesn’t really get paid to do all of these things with SBOMs and CBOMs and threat intelligence. They get paid to sell devices.
“So a lot of manufacturers never set these systems up to alert them to these problems.
“And realize there’s also a scale issue here. There’s a lot of manufacturers that have 50 people 100 people 150 people. There’s a lot of manufacturers that are still effectively small to medium business. They may not even understand that they need to have threat intelligence, SBOMs, CBOMs. They may have no way to track which version of firmware clients are using to make sure that they’re updated properly.
“That’s just one side of this.
“Now let’s talk about the Linux side. Since this is a networking bug, Ubuntu hasn’t even decided to fix it. Last I checked, they hadn’t planned to.
“So now you’ve got something that is a bug in an underlying piece of software, the operating system. This isn’t in the application that company XYZ wrote to run on top of it. Are they even tracking that?
“This is a huge bug and vulnerability that’s falling through the cracks. This is a monstrous threat in an industry where threat in intelligence is not universally deployed. Or even close.
“Whose responsibility is it? If this was a cloud environment, there’s a shared responsibility model that clearly lays that out. With connected devices oftentimes that’s not elucidated properly.
This is one where some people can patch their way out of this. But other people who run Linux who do not know that they run Linux, this is a real problem. And one that relies on the vendors to do the right thing. If they care.
Related
This entry was posted on November 3, 2026 at 1:15 pm and is filed under Commentary with tags LINUX. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Critical Linux Flaw Exposes a Bigger Blind Spot in Connected Device Security
If you run Linux, you might want to pay attention to CVE-2026-98432. This is a critical Linux vulnerability that could allow remote attackers to take control of affected systems, is raising an important question for manufacturers of connected devices and industrial equipment: How do you protect products when you don’t necessarily know what’s running inside them?
Joshua Marpet, Sr. Product Security Consultant, Finite State:
“This is a significantly bad problem. This is a problem effectively anybody could take control of a Linux system that’s affected by this. And of course, that’s horribly bad.
“Assume a system which is taking readings from a power plant. Now you can’t trust those readings. And you may not even know that.
“Assume a system that controls a power plant. Now that system could be under hostile control. And you may not even know that you’re vulnerable.
“Because unless a manufacturer is tracking all of the code that they’ve ever written, and all of the versions of the firmware that they’ve ever written, with proper software bills of materials (SBOMs), and proper cryptographic bills of materials (CBOMs), and they’re tracking all of the potential threats and vulnerabilities (threat intelligence), they may never hear about the vulnerability, and they may never be able to tie the vulnerability to an older version of firmware that 100s of clients may still be running.
“And remember a manufacturer doesn’t really get paid to do all of these things with SBOMs and CBOMs and threat intelligence. They get paid to sell devices.
“So a lot of manufacturers never set these systems up to alert them to these problems.
“And realize there’s also a scale issue here. There’s a lot of manufacturers that have 50 people 100 people 150 people. There’s a lot of manufacturers that are still effectively small to medium business. They may not even understand that they need to have threat intelligence, SBOMs, CBOMs. They may have no way to track which version of firmware clients are using to make sure that they’re updated properly.
“That’s just one side of this.
“Now let’s talk about the Linux side. Since this is a networking bug, Ubuntu hasn’t even decided to fix it. Last I checked, they hadn’t planned to.
“So now you’ve got something that is a bug in an underlying piece of software, the operating system. This isn’t in the application that company XYZ wrote to run on top of it. Are they even tracking that?
“This is a huge bug and vulnerability that’s falling through the cracks. This is a monstrous threat in an industry where threat in intelligence is not universally deployed. Or even close.
“Whose responsibility is it? If this was a cloud environment, there’s a shared responsibility model that clearly lays that out. With connected devices oftentimes that’s not elucidated properly.
This is one where some people can patch their way out of this. But other people who run Linux who do not know that they run Linux, this is a real problem. And one that relies on the vendors to do the right thing. If they care.
Share this:
Like this:
Related
This entry was posted on November 3, 2026 at 1:15 pm and is filed under Commentary with tags LINUX. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.