Linux CVE-2026-98432 (CVSS 9.8)

[PBX128]

Hey!

Is Linux CVE-2026-98432 relevant for 3CX?

We received a cybersecurity advisory regarding a critical Linux kernel vulnerability. Since our 3CX server is by design publicly accessible from the internet, it maybe falls into the high-risk category for this type of network-stack exploit.

Could you please clarify if 3CX systems (especially the standard Debian-based deployments) are affected by this IPv4 TCP stack vulnerability, and if a platform update or specific mitigation is required?
For reference, here are the public details:
• EUVD Registry: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102025
• GitHub Advisory Database: https://github.com/advisories/GHSA-QP6H-4HVH-QQQC

Thank you!

 

[NikosT_3CX]

@PBX128 Please be advised that in yesterday release of the Update 10 RC2 we have also release OS security updates that include the 6.1.190-1 which fix the CVE based on debian documention:
https://security-tracker.debian.org/tracker/CVE-2026-98432

 

[PBX128]

okay, but we are on u9 stable (20.0.9.995), not on u10 beta/RC

 

[Charles_3CX]

U10 will be released shortly; we don't yet have an exact ETA, but it will not be long now.

 

[bitn2]

U10 will be released shortly; we don't yet have an exact ETA, but it will not be long now.

But what about the systems on U9? The patch needs to be installed there as well! How can we go about this?

 

[KyriacosS_3CX]

Hello, please see here; https://www.3cx.com/community/threa...8432-not-available-for-3cx.138522/post-666846

 

[UCMUserAZ]

Installed. No issues. Thanks for being on top of these CVE's!