Kernel Patch Triage Kit

修正済みのサーバー、待機中のサーバー、最初にパッチすべきサーバーが一目でわかる——一度のトリアージで。

運用中の全マシンをカーネルとディストリビューションのパッチ状況にマッピングするトリアージシート。CVE-2026-98432のようなカーネルの欠陥への対処を、勘ではなく証拠にもとづいて優先付けできる。

こんな方におすすめ

システム管理者、SRE、Linuxフリートの責任を負う少人数チーム。

所要時間

フリートの棚卸しを一通り行うのに約30〜45分。

レベル

中級

3ステップでインストール

登録不要。CLIツールも不要です。お使いのAIを選んで、1行コピーして貼るだけです。

Pro — 全531件のスキル

ご自分で入れたい場合は、スキルを購入（$4.99）し、購入完了画面からZIPをダウンロードして、上のディレクトリに展開し、AIのセッションを再起動してください。結果は同じです。すでに購入済みの場合は、AIアシスタントにダウンロードしてもらうこともできます。

パックの内容

SKILL.md（手順書）1点とスターターテンプレート1点が入っています。プレビューはこちらです：

Kernel Patch Triage Kit

The idea in one paragraph

When a critical kernel flaw drops, the hard part is not reading the advisory — it is knowing which of your machines are actually exposed, which already carry the fix, and which ones to patch first. This kit gives you a repeatable pass: inventory every host, match each kernel against the fixed versions, check the distro's own patch status, and rank the fleet by exposure. It was built around CVE-2026-98432, a CVSS 9.8 race condition in the Linux TCP handshake, because that case shows every wrinkle: multiple fixed kernel lines, distros patching at different speeds, and software (like Go 1.24+ servers) that widens exposure without being the bug itself.

What it is built on

Only verified facts from the CVE-2026-98432 record are used as the worked example:

CVE-2026-98432 is a race condition / use-after-free in the Linux kernel IPv4 TCP handshake: inet_opt/ireq_opt can be freed while another CPU is still reading them.
The kernel CNA scored it CVSS 3.1 9.8 (Critical), and it affects all kernels since 4.4 (2016).
Fixed kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3, released between October 11 and October 18, per public reporting.
Red Hat raised it to Critical on October 30, published an nftables interim filtering rule, and pushed RHEL 8/9/10 fixes on November 1.
Ubuntu was still listed as "Vulnerable" as of November 1; Debian, Oracle, Amazon, and SUSE were partially patched.
Go 1.24 and later enable MPTCP by default, which put Caddy webserver users in scope — the bug is in the kernel, not in Caddy.
As of November 1 there was no confirmed exploitation in the wild, and the CVE was not in CISA KEV.

Workflow

Inventory your fleet (input: server list or CMDB export -> output: host to kernel version to distro table). Write down every host you are responsible for, its running kernel (uname -r on each), and its distro plus release. Include VMs, containers' hosts (the host kernel is what matters), and anything you forgot about last time. Gaps in this table are the whole reason triage fails.
Match each host against the fixed kernel lines (input: inventory table -> output: patched / vulnerable / unknown per host). For CVE-2026-98432, any host on 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3, or a later build in the same line counts as carrying the upstream fix. Anything older, or anything you cannot confirm, goes in the vulnerable/unknown column. Do not guess — "unknown" is a valid and honest status.
Check the distro's own advisory (input: distro plus release -> output: distro patch status per host). Distro kernels backport fixes, so the upstream version number alone can mislead. Look up the vendor advisory: Red Hat's Critical rating and its October 30 nftables interim rule, Ubuntu's "Vulnerable" status as of November 1, and the partial states for Debian, Oracle, Amazon, and SUSE all came from the vendors themselves. Record the advisory link and date for each line.
Rank by exposure (input: patch status plus service exposure -> output: prioritized patch order). Sort the vulnerable hosts by who is reachable and how: internet-facing services first, then anything running MPTCP listeners (remember that Go 1.24+ enables MPTCP by default, which quietly widens the exposed set), then internal systems, then the rest. Exposure outranks age of kernel.
Patch, mitigate, and verify (input: priority order -> output: post-patch verification record). Apply the vendor fix in priority order; where a fix is not yet available, apply the vendor's interim mitigation (for example Red Hat's nftables rule) and note its limits. After each patch, re-check the running kernel and the advisory status, and record both. A host is done only when the running kernel matches a fixed version or a vendor-confirmed backport.