CVE-2026-98432 in Proxmox VE

[hannsr]

Hi,

I couldn't find a clear answer online whether CVE-2026-98432 has been adressed by the Proxmox Kernel or not. Or whether it is vulnerable at all to be prescise.

Thanks in advance for any feedback!

 

[LnxBil]

Proxmox (in all of their producs) use an Ubuntu LTS based kernel, so this entry should be applicable:

26.04 LTS resolute

Vulnerable work in progress in 7.0.0-43.43

 

[feligato]

I thought is a debian based distro

 

[leesteken]

Yes but the kernel is based on Ubuntu.

 

[bbgeek17]

Hi @hannsr

Yes, the Proxmox kernel is affected, but the fix is already included in the current kernels.

The upstream fix is a small change in the IPv4 code (net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c). It reached the Ubuntu 7.0.0-43 kernel source, and the Proxmox kernel is built on that source starting with 7.0.14-25-pve. Older Proxmox kernels (7.0.14-24 and earlier) don't have it.

Both 7.0.14-25 and 7.0.14-26 are available in the no-subscription and test repositories. Ubuntu's CVE page still shows "work in progress" for 7.0.0-43. As far as I can tell, that only means Ubuntu hasn't marked the fix as released yet, even though the code is already there.

Run uname -r - anything at 7.0.14-25-pve or newer has the fix.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[hannsr]

Proxmox (in all of their producs) use an Ubuntu LTS based kernel, so this entry should be applicable:

26.04 LTS resolute

Vulnerable work in progress in 7.0.0-43.43

Thanks, I wasn't sure if that's accurate.

The upstream fix is a small change in the IPv4 code (net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c). It reached the Ubuntu 7.0.0-43 kernel source, and the Proxmox kernel is built on that source starting with 7.0.14-25-pve. Older Proxmox kernels (7.0.14-24 and earlier) don't have it.

Run uname -r - anything at 7.0.14-25-pve or newer has the fix.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

Also thanks for the detailed Information! Much appreciated

 

[bbgeek17]

As far as I can tell, the fix doesn't seem to be in the Proxmox kernel yet.
I think the best we can do is wait for an official security advisory from Proxmox and a kernel update that includes the fix.

The fix is already in the current PVE kernel. Here's the chain:

1. Upstream fix ("ipv4: free inet_opt and ireq_opt after an RCU grace period"):
https://git.kernel.org/pub/scm/linu.../?id=e3f33b0a1d89d738e2b913dab519226eaf76e15b
2. Ubuntu backported it into their 7.0 kernel (commit 091732b7, part of Ubuntu-7.0.0-43.43):
https://git.launchpad.net/~ubuntu-k.../?id=091732b7e3d94eaaa7276c279e35cf1cd00acb27
3. The PVE kernel moved its Ubuntu source from Ubuntu-7.0.0-39.39 to Ubuntu-7.0.0-43.43i1 (submodule 874594fa -> 49ecb900), which includes that backport:
https://git.proxmox.com/?p=pve-kernel.git;a=commitdiff;h=52cb2c6eabbdaa8b18a515ca2928a5a2d50c62c7
4. The first PVE kernel built on that source is 7.0.14-25:
https://git.proxmox.com/?p=pve-kernel.git;a=commit;h=af11302954864678da19aa13b2daa38231b26299

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[Carlos Gomes]

Thanks for the chain update. Can you guys confirm that on 7.0.14-24-pve is already mitigated?

 

[bbgeek17]

Thanks for the chain update. Can you guys confirm that on 7.0.14-24-pve is already mitigated?

4. The first PVE kernel built on that source is 7.0.14-25:

7.0.14-24 is before 7.0.14-25, so I believe the answer to your question is "no". That said, I can be mistaken - so do check! If you have support subscription - they are the best people to confirm.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox