Patched kernel against CVE-2026-98432 not available for 3cx

[antrill]

Hello,
I noticed that a pretty scary CVSS 9.8 vulnerability exists in the Linux kernel, see https://nvd.nist.gov/vuln/detail/cve-2026-98432.
Although there is no public exploit yet, this might quickly evolve into something really nasty, needing only a single IPv4 TCP listener of any kind, which 3cx has.
Debian bookworm LTS has updated kernels already (which is better than Ubuntu at the time of my post): https://security-tracker.debian.org/tracker/CVE-2026-98432
Unfortunately, the 3cx repo does not offer this, the kernel is from May 2026.
Linux 3cx 6.1.0-49-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.174-1 (2026-05-26) x86_64 GNU/Linux

So please, consider putting the updated kernel onto your mirrors.

 

[NikosT_3CX]

@antrill please note that with the release of the Update 10 RC2 we have also release OS security updates that will include the 6.1.190-1 which fix the CVE based on debian documention:
https://security-tracker.debian.org/tracker/CVE-2026-98432

 

[bitn2]

@antrill please note that with the release of the Update 10 RC2 we have also release OS security updates that will include the 6.1.190-1 which fix the CVE based on debian documention:
https://security-tracker.debian.org/tracker/CVE-2026-98432

However, RC2 is not being used in a production environment. It is important that, if U10 is not released in a timely manner, a patch for U9 is also made available.

 

[AndreasY_3CX]

Hi @antrill & @bitn2,

We've now pushed new Debian Bookworm security packages to the 3CX repository, including the updated kernel.

You can find the details in our PBX Security Updates changelog.

Thanks again for the heads-up!