Linux CVE-2026-98432 (CVSS 9.8)

[PBX128]

Hey!

Is Linux CVE-2026-98432 relevant for 3CX?

We received a cybersecurity advisory regarding a critical Linux kernel vulnerability. Since our 3CX server is by design publicly accessible from the internet, it maybe falls into the high-risk category for this type of network-stack exploit.

Could you please clarify if 3CX systems (especially the standard Debian-based deployments) are affected by this IPv4 TCP stack vulnerability, and if a platform update or specific mitigation is required?
For reference, here are the public details:
• EUVD Registry: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102025
• GitHub Advisory Database: https://github.com/advisories/GHSA-QP6H-4HVH-QQQC

Thank you!

 

[NikosT_3CX]

@PBX128 Please be advised that in yesterday release of the Update 10 RC2 we have also release OS security updates that include the 6.1.190-1 which fix the CVE based on debian documention:
https://security-tracker.debian.org/tracker/CVE-2026-98432

 

[PBX128]

okay, but we are on u9 stable (20.0.9.995), not on u10 beta/RC

 

[Charles_3CX]

U10 will be released shortly; we don't yet have an exact ETA, but it will not be long now.