Subject: PSA-2026-00037-1: SCTPhantom Local Privilege Escalation issue
Advisory date: 2026-08-10
Packages: proxmox-kernel-*
Details:
A use-after-free issue in the Linux kernels SCTP code allowed a unprivileged local attacker to obtain root privileges, and potentially escape from unprivileged containers.
Mitigations:
Preventing the sctp module from being loaded mitigates the issue.
Fixed in:
- proxmox-kernel-7.0.14-10-pve(-signed) (Trixie based products)
- proxmox-kernel-6.8.12-41-pve(-signed) (Bookworm based products)
Subject: PSA-2026-00038-1: TONTOU kernel memory leak via branch predictor re-poisoning
Advisory date: 2026-08-10
Packages: proxmox-kernel-*
Details:
A new technique to leak kernel memory despite spectre v2 mitigations being in place to neutralize the branch predictor state was discovered. This technique uses interrupt injection to re-poison the branch predictor during the window between neutralization and return of execution.
This technique is only applicable on AMD and Intel CPUs.
Fixed in:
- proxmox-kernel-7.0.14-11-pve(-signed) (Trixie based products)
- proxmox-kernel-6.8.12-41-pve(-signed) (Bookworm based products)
Subject: PSA-2026-00039-1: missing parameter validation in remote migration
Advisory date: 2026-08-12
Packages: qemu-server
Details:
Missing parameter validation in Proxmox VE's remote migration code allowed an attacker with Sys.Incoming privileges to inject arbitrary values in parts of the QEMU command line on the migration target.
Subject: PSA-2026-00040-1: incomplete privilege checks for unused volumes
Advisory date: 2026-08-12
Packages: qemu-server, pve-container
Details:
Incomplete privilege checks when adding an unused volume to a guest allowed accessing volumes that were out of scope for the user/API token adding the volume.
This issue was reported privately by Geoffrey McClinsey <geoffrey.mcclinsey@gmail.com> for qemu-server, a related issue in pve-container was found while developing the fix.
