# Fleet GitOps policies for CVE-2026-98432 (Linux IPv4 TCP use-after-free), Ubuntu hosts.
# Flat list, the format `fleetctl gitops` expects. Put it in your fleet's lib/ folder and
# reference it with `policies: - path: ../lib/cve-2026-98432-policies.yml`. Upload
# cve-2026-98432-mitigate.sh under `controls: scripts:` in the SAME fleet: a run_script path must
# match a script defined in that fleet.
#
# Script automation on a policy needs Fleet Premium and a fleet-level policy (not a global one).
#
# Both policies run the SAME script. With no argument it applies the mitigation on a kernel
# without the fix and removes it on a kernel with the fix.
#
# The fixed versions are Ubuntu's provisional targets (24.04: 6.8.0-149.149, 26.04: 7.0.0-43.43),
# matched here by ABI number (149, 43) so the query never scans deb_packages. Keep them in step
# with fixed_for() in the script, and confirm them against
# https://ubuntu.com/security/CVE-2026-98432 once Ubuntu releases the fix.

- name: CVE-2026-98432 - Ubuntu kernel patched or mitigated
  description: >-
    Passes when the running kernel carries the fix, or the interim mitigation is in place:
    IPv4 TCP with IP options dropped, MPTCP off, unit active. Non-Ubuntu hosts pass; patch
    those through their vendor kernel.
  resolution: >-
    Fleet runs cve-2026-98432-mitigate.sh automatically. To run it by hand, open the host, then
    Actions, then Run script. Install the patched kernel and reboot when Ubuntu releases it.
  platform: linux
  critical: true
  query: |
    SELECT 1 FROM os_version
    WHERE platform != 'ubuntu'
       OR EXISTS (
         SELECT 1 FROM os_version o, kernel_info k
         WHERE (o.major = 24 AND k.version LIKE '6.8.0-%-generic'
                AND CAST(substr(k.version, 7) AS INTEGER) >= 149)
            OR (o.major = 26 AND k.version LIKE '7.0.0-%-generic'
                AND CAST(substr(k.version, 7) AS INTEGER) >= 43))
       OR ((SELECT current_value FROM system_controls WHERE name = 'net.mptcp.enabled') = '0'
           AND EXISTS (SELECT 1 FROM file WHERE path = '/etc/cve-2026-98432.nft')
           AND EXISTS (SELECT 1 FROM systemd_units
                       WHERE id = 'cve-2026-98432-mitigation.service' AND active_state = 'active'));
  run_script:
    path: ../lib/cve-2026-98432-mitigate.sh

- name: CVE-2026-98432 - Mitigation removed after kernel patch
  description: >-
    Fails on a host that runs a kernel with the fix but still has the interim mitigation files.
    Running the script removes them.
  resolution: >-
    Fleet runs cve-2026-98432-mitigate.sh automatically; on a patched kernel it removes the
    mitigation.
  platform: linux
  critical: false
  query: |
    SELECT 1 FROM os_version
    WHERE platform != 'ubuntu'
       OR NOT (
         EXISTS (
           SELECT 1 FROM os_version o, kernel_info k
           WHERE (o.major = 24 AND k.version LIKE '6.8.0-%-generic'
                  AND CAST(substr(k.version, 7) AS INTEGER) >= 149)
              OR (o.major = 26 AND k.version LIKE '7.0.0-%-generic'
                  AND CAST(substr(k.version, 7) AS INTEGER) >= 43))
         AND (EXISTS (SELECT 1 FROM file WHERE path = '/etc/cve-2026-98432.nft')
              OR EXISTS (SELECT 1 FROM file WHERE path = '/etc/sysctl.d/99-cve-2026-98432.conf')
              OR EXISTS (SELECT 1 FROM file WHERE path = '/etc/systemd/system/cve-2026-98432-mitigation.service')));
  run_script:
    path: ../lib/cve-2026-98432-mitigate.sh