What's inside

One SKILL.md (the playbook) + one starter template. A preview:

Kernel Patch Triage Kit

The idea in one paragraph

When a critical kernel flaw drops, the hard part is not reading the advisory — it is knowing which of your machines are actually exposed, which already carry the fix, and which ones to patch first. This kit gives you a repeatable pass: inventory every host, match each kernel against the fixed versions, check the distro's own patch status, and rank the fleet by exposure. It was built around CVE-2026-98432, a CVSS 9.8 race condition in the Linux TCP handshake, because that case shows every wrinkle: multiple fixed kernel lines, distros patching at different speeds, and software (like Go 1.24+ servers) that widens exposure without being the bug itself.

What it is built on

Only verified facts from the CVE-2026-98432 record are used as the worked example:

• CVE-2026-98432 is a race condition / use-after-free in the Linux kernel IPv4 TCP handshake: inet_opt/ireq_opt can be freed while another CPU is still reading them.
• The kernel CNA scored it CVSS 3.1 9.8 (Critical), and it affects all kernels since 4.4 (2016).
• Fixed kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3, released between October 11 and October 18, per public reporting.
• Red Hat raised it to Critical on October 30, published an nftables interim filtering rule, and pushed RHEL 8/9/10 fixes on November 1.
• Ubuntu was still listed as "Vulnerable" as of November 1; Debian, Oracle, Amazon, and SUSE were partially patched.
• Go 1.24 and later enable MPTCP by default, which put Caddy webserver users in scope — the bug is in the kernel, not in Caddy.
• As of November 1 there was no confirmed exploitation in the wild, and the CVE was not in CISA KEV.

Workflow

1. Inventory your fleet (input: server list or CMDB export -> output: host to kernel version to distro table). Write down every host you are responsible for, its running kernel (uname -r on each), and its distro plus release. Include VMs, containers' hosts (the host kernel is what matters), and anything you forgot about last time. Gaps in this table are the whole reason triage fails.
2. Match each host against the fixed kernel lines (input: inventory table -> output: patched / vulnerable / unknown per host). For CVE-2026-98432, any host on 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3, or a later build in the same line counts as carrying the upstream fix. Anything older, or anything you cannot confirm, goes in the vulnerable/unknown column. Do not guess — "unknown" is a valid and honest status.
3. Check the distro's own advisory (input: distro plus release -> output: distro patch status per host). Distro kernels backport fixes, so the upstream version number alone can mislead. Look up the vendor advisory: Red Hat's Critical rating and its October 30 nftables interim rule, Ubuntu's "Vulnerable" status as of November 1, and the partial states for Debian, Oracle, Amazon, and SUSE all came from the vendors themselves. Record the advisory link and date for each line.
4. Rank by exposure (input: patch status plus service exposure -> output: prioritized patch order). Sort the vulnerable hosts by who is reachable and how: internet-facing services first, then anything running MPTCP listeners (remember that Go 1.24+ enables MPTCP by default, which quietly widens the exposed set), then internal systems, then the rest. Exposure outranks age of kernel.
5. Patch, mitigate, and verify (input: priority order -> output: post-patch verification record). Apply the vendor fix in priority order; where a fix is not yet available, apply the vendor's interim mitigation (for example Red Hat's nftables rule) and note its limits. After each patch, re-check the running kernel and the advisory status, and record both. A host is done only when the running kernel matches a fixed version or a vendor-confirmed backport.

Template preview

Kernel Patch Triage Worksheet

Fill this in during your triage pass. One row per host.

1. Fleet inventory

2. Fixed-version match (worked example: CVE-2026-98432)

Fixed upstream kernels: 5.10.272 / 5.15.223 / 6.1.190 / 6.6.159 / 6.12.113 / 6.18.56 / 7.2.10 / 7.3 (released Oct 11-18).

3. Exposure ranking

Exposure notes to consider: internet-facing services first; MPTCP listeners next (Go 1.24+ enables MPTCP by default); then internal systems.

4. Verification record

Reminder: a host is done only when the running kernel matches a fixed version or a vendor-confirmed backport.

Buy the full skill pack — $4.99 Pro — all 531 skills