[SOLVED] CVE-2026-99999 or the Vercel KVM Zero-Day

[joru]

After the news of a possible KVM escape made the rounds at the start of the month, we finally got some more information and a patch to fix it:

• https://www.cve.org/CVERecord?id=CVE-2026-99999
• https://pwn.ai/blog/pwnescape
• https://github.com/torvalds/linux/commit/6785011f8b16abf40b1e9d8b2e332232b3e68822

I'm sure that a patch release for the proxmox kernel is already on its way, but could you still clear up a few things beforehand?

• When can we expect a new release for the kernel package?
• Which versions of the proxmox-kernel packages will be patched?
• Will the latest kernel for proxmox ve 8 still be patched, even though it is not officially supported anymore?

Not all of our systems can be restarted without some planning and notifying people, a rough timeline would be greatly appreciated!

 

[fabian]

the fix is included in proxmox-kernel-7.0.14-24-pve(-signed), which is currently available up to the pve-no-subscription repository and will hit enterprise soon.

the 7.0.14 series is the only currently supported kernel series, there won't be updates for EOL kernel series or product releaess.

 

[joru]

Okay, good to know. Thank you for the quick reply!