https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/post-873167 indicates that this was fixed in proxmox-kernel-7.0.14-24-pve(-signed). However, if I have 6.x kernels for legacy or compatibility reasons, are they affected? Is there a backport available if so, or is the only mitigation the kernel listed above (or newer)?
Does PSA-2026-00068-1 Affect Kernels 6.x?
- Thread starter tonystriker
- Start date
Don't expect backports, as all earlier kernel versions are no longer supported by Proxmox: https://forum.proxmox.com/threads/cve-2026-99999-or-the-vercel-kvm-zero-day.187089/post-873440 . Since different vulnerabilities keep popping up all the time, I urge you to upgrade to a supported version, instead of searching of mitigations or fixes for this particular CVE.
Hi @tonystriker , welcome to the forum.
Looking at the Proxmox kernel changelogs, the relevant fixes appear in the 7.0 series in October 2026. The 7.0.14-23 changelog includes virtio-net header validation, and Proxmox identifies 7.0.14-24 (or newer) as the fixed version for this advisory.
The older kernel series were last updated considerably earlier. The last 6.17 package I found was 6.17.13-2, dated March 13, 2026, while the last 6.8 package was 6.8.12-43, dated August 2026. And both are now EOL.
So, while the underlying issue isn't specific to Linux 7.x, Proxmox did not backport the fix to its older 6.x kernels. If you need to stay on 6.x for compatibility reasons, I'd treat it as potentially vulnerable. The supported option is to move to 7.0.14-24 or newer. Unsupported option - patch and rebuild the kernel yourself.
The question I would also ask - are you running trusted or untrusted workload?
Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox
Looking at the Proxmox kernel changelogs, the relevant fixes appear in the 7.0 series in October 2026. The 7.0.14-23 changelog includes virtio-net header validation, and Proxmox identifies 7.0.14-24 (or newer) as the fixed version for this advisory.
The older kernel series were last updated considerably earlier. The last 6.17 package I found was 6.17.13-2, dated March 13, 2026, while the last 6.8 package was 6.8.12-43, dated August 2026. And both are now EOL.
So, while the underlying issue isn't specific to Linux 7.x, Proxmox did not backport the fix to its older 6.x kernels. If you need to stay on 6.x for compatibility reasons, I'd treat it as potentially vulnerable. The supported option is to move to 7.0.14-24 or newer. Unsupported option - patch and rebuild the kernel yourself.
The question I would also ask - are you running trusted or untrusted workload?
Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox
I will upgrade when I can. I did want to validate it was actually in 6.x workloads before rushing to rearrange my schedule to adjust. Setting priorities - am I wasting time working on 6.x kernels when I have other 7.x kernels that need addressing first.