[SOLVED] CVE-2026-99999 or the Vercel KVM Zero-Day

J

joru

Member
Oct 4, 2023
5
2
8
After the news of a possible KVM escape made the rounds at the start of the month, we finally got some more information and a patch to fix it:
I'm sure that a patch release for the proxmox kernel is already on its way, but could you still clear up a few things beforehand?
  • When can we expect a new release for the kernel package?
  • Which versions of the proxmox-kernel packages will be patched?
  • Will the latest kernel for proxmox ve 8 still be patched, even though it is not officially supported anymore?
Not all of our systems can be restarted without some planning and notifying people, a rough timeline would be greatly appreciated!
 
the fix is included in proxmox-kernel-7.0.14-24-pve(-signed), which is currently available up to the pve-no-subscription repository and will hit enterprise soon.

the 7.0.14 series is the only currently supported kernel series, there won't be updates for EOL kernel series or product releaess.
 
  • Like
Reactions: pwhr7qjZ7C, vmwombat, ebiss and 4 others
It's available now on enterprise as well.

Unfortunately, the nvidia driver (tried the newest 615.78.08) is not compiling for kernel 7.0.14-24-pve, lots of "error: field ‘cxlds’ has incomplete type".
 
fabian said:
the fix is included in proxmox-kernel-7.0.14-24-pve(-signed), which is currently available up to the pve-no-subscription repository and will hit enterprise soon.

the 7.0.14 series is the only currently supported kernel series, there won't be updates for EOL kernel series or product releaess.
Click to expand...

Hello,
Thank you for prompt action.
Is there a way to patch this vulnerability without rebooting the host server?
 
Johannes S said:
No, like every kernel update you need to reboot have the new kernel running. If you have more than one node you could migrate your workloads to the other before and after the reboot.
Click to expand...

I’m aware of that. However, given the growing number of kernel vulnerabilities, the need for live kernel patching is becoming more important than ever.
 
debian10 said:
I’m aware of that. However, given the growing number of kernel vulnerabilities, the need for live kernel patching is becoming more important than ever.
Click to expand...
Not really. Even with live-patching you have a ( allthough smaller ) downtime and usually something like kernelcare addresses only some but not all issues. Live patching is NOT an universal bandaid for currents worst practices of compilance-theater-bullshit-regulated enterprise it.
 
  • Like
Reactions: InfraGuy
I immediately upgraded my proxmox hosts through a rolling upgrade after hearing about this, I'm running a VPS backed by proxmox.
 
  • Like
Reactions: Johannes S
because the changelog predates the CVE assignment by almost a week:

changelog bump on 09.10: https://git.proxmox.com/?p=pve-kernel.git;a=commitdiff;h=316d1680efe8277d3ce6d8b2cf2e19c838e9173a
CVE assignment on 15.10.: https://lore.kernel.org/linux-cve-announce/2026101533-CVE-2026-99999-beee@gregkh/

the patch itself was explicitly called out in the -22 changelog release:

06.10.: https://git.proxmox.com/?p=pve-kernel.git;a=commitdiff;h=e69821871bd593d93fd5599833401752103ca958

-24 just replaced that earlier version/variant of the fix with the final one.
 
  • Like
Reactions: Onslow, meyergru and laph
Hi,

Has an update been released for the following kernel versions?

uname -r
5.4.162-1-pve

uname -r
6.8.12-43-pve

uname -r
5.15.107-2-pve

uname -r
6.8.12-20-pve

Thanks
 
no, those kernel series (and their associated product releases) are all EOL and do not get any updates anymore.
 
Good morning fabi. Any updated ETA on that? C-Level has me on redial :confused:
 
My bad. There was an issue with out patch-routine which prevented us to see the patch. As far is i can see, the -24 kernel got released on 17.10 for enterprise, correct?
 
Do the kernel update for PwnEscape already available (and stable) on Enterprise Repo?
 
SMN1441 said:
Hi,

Has an update been released for the following kernel versions?

uname -r
5.4.162-1-pve

uname -r
6.8.12-43-pve

uname -r
5.15.107-2-pve

uname -r
6.8.12-20-pve

Thanks
Click to expand...
We have have 6.8.12-20-pve kernel livepatch available. For most CVE we live patch it on PVE8/9. It is easier than reboot when managing so many server. I use kpatch.

If there is interest I can post instructions for how to apply it. Or just like publish github the patch. There is cve-2026-99999, https://www.openwall.com/lists/oss-security/2026/10/19/1 and new kvm escape every week now.

Like I am not rebooting for one CVE when there is another tomorrow across a fleet or waiting around for day when there is 0-day.
https://www.openwall.com/lists/oss-security/2026/10/19/1 is patched in -25 proxmox release but you get it. If you rebooted for -24 now you need to do -25 too.

For 7.X you do klp-build
 
Last edited:
You must log in or register to reply here.
Top Bottom
Back