CVE-2026-98432: Proxmox Virtual Environment: kernel TCP Use-After-Free (CVE-2026-98432)
This Proxmox advisory covers CVE-2026-98432 in Proxmox Virtual Environment.
Key facts
- CISA KEV
- Not listed (catalogue checked )
- Advisory id
- PSA-2026-00080
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A race in IPv4 TCP connection setup can cause a use-after-free. When a retransmitted SYN is handled on another CPU while the new connection's socket is being freed, the kernel may still read that socket's IP options to build a SYN-ACK.
A similar race exists with request socket migration (net.ipv4.tcp_migrate_req=1 or a BPF reuseport migrate program). Only SYNs carrying IPv4 options, or CIPSO/NetLabel setups, hit the affected code.
The fix frees the options only after an RCU grace period. Native IPv6 is not affected.
Packages: proxmox-kernel-*.
Affected product named by the advisory: Proxmox Virtual Environment.
Text from the source record.
How to fix CVE-2026-98432
Vendor guidance
- A similar race exists with request socket migration (net.ipv4.tcp_migrate_req=1 or a BPF reuseport migrate program).
End-of-life dates for Proxmox VE
CVE-2026-98432 in other vendors' advisories
- Fortinet: FG-IR-26-188, critical severity
- MikroTik: CVE-2026-98432
- NetApp: NTAP-20261102-0001, critical severity, fixed in E-Series SANtricity OS Controller Software: 11.90R7, E-Series SANtricity OS Controller Software: 12.10R1
- Red Hat: CVE-2026-98432, critical severity, fixed in kernel-0:6.12.0-265.31.el10nv, kernel-0:6.12.0-211.72.1.el10_2, kernel-0:5.14.0-687.64.1.el9_8 and 11 more
- Sophos: sophos-sa-20261102-linux-kernel-tcp, high severity
- Veeam: KB4966, critical severity, fixed in Veeam UpdaterVeeam Infrastructure Appliance 13.1, Veeam Infrastructure Appliance 13.1, Veeam Agent for Linux 13.1
- WatchGuard: WGSA-2026-0033, critical severity
More Proxmox advisories
PSA-2026-00095Nov 10, 2026Proxmox Virtual Environment: Broken privilege checks when modifying container NICsPSA-2026-00094Nov 10, 2026Proxmox Virtual Environment: OCI extraction path escapePSA-2026-00093Nov 10, 2026Proxmox Virtual Environment: FRR config injection issuesPSA-2026-00092Nov 10, 2026Proxmox Virtual Environment: Missing and incomplete ACL checks in the SDN APIPSA-2026-00089Nov 10, 2026Proxmox: Several issues in libpve-http-server-perlPSA-2026-00088Nov 10, 2026Proxmox Virtual Environment: Shell command injection via volume name
Get an email when Proxmox Virtual Environment (VE) publishes the next one.
See Proxmox Virtual Environment (VE)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Proxmox CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
