CVE-2026-98432 in Proxmox VE

H

hannsr

New Member
Sep 11, 2026
3
0
1
Hi,

I couldn't find a clear answer online whether CVE-2026-98432 has been adressed by the Proxmox Kernel or not. Or whether it is vulnerable at all to be prescise.

Thanks in advance for any feedback!
 
Hi @hannsr

Yes, the Proxmox kernel is affected, but the fix is already included in the current kernels.

The upstream fix is a small change in the IPv4 code (net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c). It reached the Ubuntu 7.0.0-43 kernel source, and the Proxmox kernel is built on that source starting with 7.0.14-25-pve. Older Proxmox kernels (7.0.14-24 and earlier) don't have it.

Both 7.0.14-25 and 7.0.14-26 are available in the no-subscription and test repositories. Ubuntu's CVE page still shows "work in progress" for 7.0.0-43. As far as I can tell, that only means Ubuntu hasn't marked the fix as released yet, even though the code is already there.

Run uname -r - anything at 7.0.14-25-pve or newer has the fix.


Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox
 
  • Like
Reactions: Johannes S
LnxBil said:
Proxmox (in all of their producs) use an Ubuntu LTS based kernel, so this entry should be applicable:

26.04 LTS resolute
Vulnerable work in progress in 7.0.0-43.43
Click to expand...
Thanks, I wasn't sure if that's accurate.
bbgeek17 said:
The upstream fix is a small change in the IPv4 code (net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c). It reached the Ubuntu 7.0.0-43 kernel source, and the Proxmox kernel is built on that source starting with 7.0.14-25-pve. Older Proxmox kernels (7.0.14-24 and earlier) don't have it.

Run uname -r - anything at 7.0.14-25-pve or newer has the fix.


Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox
Click to expand...
Also thanks for the detailed Information! Much appreciated
 
d.oishi said:
As far as I can tell, the fix doesn't seem to be in the Proxmox kernel yet.
I think the best we can do is wait for an official security advisory from Proxmox and a kernel update that includes the fix.
Click to expand...
The fix is already in the current PVE kernel. Here's the chain:

1. Upstream fix ("ipv4: free inet_opt and ireq_opt after an RCU grace period"):
https://git.kernel.org/pub/scm/linu.../?id=e3f33b0a1d89d738e2b913dab519226eaf76e15b
2. Ubuntu backported it into their 7.0 kernel (commit 091732b7, part of Ubuntu-7.0.0-43.43):
https://git.launchpad.net/~ubuntu-k.../?id=091732b7e3d94eaaa7276c279e35cf1cd00acb27
3. The PVE kernel moved its Ubuntu source from Ubuntu-7.0.0-39.39 to Ubuntu-7.0.0-43.43i1 (submodule 874594fa -> 49ecb900), which includes that backport:
https://git.proxmox.com/?p=pve-kernel.git;a=commitdiff;h=52cb2c6eabbdaa8b18a515ca2928a5a2d50c62c7
4. The first PVE kernel built on that source is 7.0.14-25:
https://git.proxmox.com/?p=pve-kernel.git;a=commit;h=af11302954864678da19aa13b2daa38231b26299


Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox
 
  • Like
Reactions: d.oishi
Carlos Gomes said:
Thanks for the chain update. Can you guys confirm that on 7.0.14-24-pve is already mitigated?
Click to expand...
bbgeek17 said:
4. The first PVE kernel built on that source is 7.0.14-25:
Click to expand...
7.0.14-24 is before 7.0.14-25, so I believe the answer to your question is "no". That said, I can be mistaken - so do check! If you have support subscription - they are the best people to confirm.

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox
 
  • Like
Reactions: Johannes S and Carlos Gomes
You must log in or register to reply here.
Top Bottom
Back