Patched kernel against CVE-2026-98432 not available for 3cx

[antrill]

Hello,
I noticed that a pretty scary CVSS 9.8 vulnerability exists in the Linux kernel, see https://nvd.nist.gov/vuln/detail/cve-2026-98432.
Although there is no public exploit yet, this might quickly evolve into something really nasty, needing only a single IPv4 TCP listener of any kind, which 3cx has.
Debian bookworm LTS has updated kernels already (which is better than Ubuntu at the time of my post): https://security-tracker.debian.org/tracker/CVE-2026-98432
Unfortunately, the 3cx repo does not offer this, the kernel is from May 2026.
Linux 3cx 6.1.0-49-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.174-1 (2026-05-26) x86_64 GNU/Linux

So please, consider putting the updated kernel onto your mirrors.

 

[NikosT_3CX]

@antrill please note that with the release of the Update 10 RC2 we have also release OS security updates that will include the 6.1.190-1 which fix the CVE based on debian documention:
https://security-tracker.debian.org/tracker/CVE-2026-98432

 

[bitn2]

@antrill please note that with the release of the Update 10 RC2 we have also release OS security updates that will include the 6.1.190-1 which fix the CVE based on debian documention:
https://security-tracker.debian.org/tracker/CVE-2026-98432

However, RC2 is not being used in a production environment. It is important that, if U10 is not released in a timely manner, a patch for U9 is also made available.

 

[AndreasY_3CX]

Hi @antrill & @bitn2,

We've now pushed new Debian Bookworm security packages to the 3CX repository, including the updated kernel.

You can find the details in our PBX Security Updates changelog.

Thanks again for the heads-up!

 

[AWS2P]

We've now pushed new Debian Bookworm security packages to the 3CX repository, including the updated kerne

Hello,
does this means the update is automatically applied on U9 machines ? if not , how do we need to proceed to get this fix on the pbx?

 

[bitn2]

Hello,
does this means the update is automatically applied on U9 machines ? if not , how do we need to proceed to get this fix on the pbx?

You need to enable automatic updates, and then it will be installed as part of that process. If you want it done quickly, simply set the time window for automatic updates to, for example, tonight.

 

[UCMUserAZ]

Hi @antrill & @bitn2,

We've now pushed new Debian Bookworm security packages to the 3CX repository, including the updated kernel.

You can find the details in our PBX Security Updates changelog.

Thanks again for the heads-up!

No issues. Installed. Thanks.