Patched kernel against CVE-2026-98432 not available for 3cx

[antrill]

Hello,
I noticed that a pretty scary CVSS 9.8 vulnerability exists in the Linux kernel, see https://nvd.nist.gov/vuln/detail/cve-2026-98432.
Although there is no public exploit yet, this might quickly evolve into something really nasty, needing only a single IPv4 TCP listener of any kind, which 3cx has.
Debian bookworm LTS has updated kernels already (which is better than Ubuntu at the time of my post): https://security-tracker.debian.org/tracker/CVE-2026-98432
Unfortunately, the 3cx repo does not offer this, the kernel is from May 2026.
Linux 3cx 6.1.0-49-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.174-1 (2026-05-26) x86_64 GNU/Linux

So please, consider putting the updated kernel onto your mirrors.

 

[NikosT_3CX]

@antrill please note that with the release of the Update 10 RC2 we have also release OS security updates that will include the 6.1.190-1 which fix the CVE based on debian documention:
https://security-tracker.debian.org/tracker/CVE-2026-98432

 

[bitn2]

@antrill please note that with the release of the Update 10 RC2 we have also release OS security updates that will include the 6.1.190-1 which fix the CVE based on debian documention:
https://security-tracker.debian.org/tracker/CVE-2026-98432

However, RC2 is not being used in a production environment. It is important that, if U10 is not released in a timely manner, a patch for U9 is also made available.

 

[AndreasY_3CX]

Hi @antrill & @bitn2,

We've now pushed new Debian Bookworm security packages to the 3CX repository, including the updated kernel.

You can find the details in our PBX Security Updates changelog.

Thanks again for the heads-up!

 

[AWS2P]

We've now pushed new Debian Bookworm security packages to the 3CX repository, including the updated kerne

Hello,
does this means the update is automatically applied on U9 machines ? if not , how do we need to proceed to get this fix on the pbx?

 

[bitn2]

Hello,
does this means the update is automatically applied on U9 machines ? if not , how do we need to proceed to get this fix on the pbx?

You need to enable automatic updates, and then it will be installed as part of that process. If you want it done quickly, simply set the time window for automatic updates to, for example, tonight.

 

[UCMUserAZ]

Hi @antrill & @bitn2,

We've now pushed new Debian Bookworm security packages to the 3CX repository, including the updated kernel.

You can find the details in our PBX Security Updates changelog.

Thanks again for the heads-up!

No issues. Installed. Thanks.

 

[KyriacosS_3CX]

Hello, for Update 9 OS level updates are not tracked in the PBX updates page (Update 10 is introducing an OS level update notification channel).

So in order to get this new kernel you need to either set your PBX to Auto-Update, as that process does install OS updates, or run the relevant debian shell commands. A reboot will be needed at the end for the fix to become effective.

 

[AWS2P]

A reboot will be needed at the end for the fix to become effective.

Hello, if updates are enabled on the pbx is the reboot automatically done ? or do i need to do it everywhere?
is there a log available in the GUI to follow which updates have already been done?

 

[bitn2]

Hello, if updates are enabled on the pbx is the reboot automatically done ? or do i need to do it everywhere?
is there a log available in the GUI to follow which updates have already been done?

No, 3CX reboots never happen automatically.

 

[NikosT_3CX]

@AWS2P and @bitn2 please note that if needed and its required the reboot will happen on out of office hours of the PBX.
Lets say you have Automatic updates enabled at 08:00 AM or you download the Security updates at 08:00 AM.
The PBX will download them and install them that time.
But if a reboot is required to be applied ( like a Kernel one ) the PBX will do it at 03:00 - 04:00 AM ( out of office hours of the PBX ) in order to not affect the operation of the system. The PBX knows the timezone of the OS.

 

[bitn2]

@AWS2P and @bitn2 please note that if needed and its required the reboot will happen on out of office hours of the PBX.
Lets say you have Automatic updates enabled at 08:00 AM or you download the Security updates at 08:00 AM.
The PBX will download them and install them that time.
But if a reboot is required to be applied ( like a Kernel one ) the PBX will do it at 03:00 - 04:00 AM ( out of office hours of the PBX ) in order to not affect the operation of the system. The PBX knows the timezone of the OS.

Nice! Thanks for the info. I wasn't aware of that until now. Does this happen only with Update 10, or does it already occur with Update 9?

 

[NikosT_3CX]

@bitn2 it applies in U9, U8 and even before

 

[sam.hawkins]

Hello, if updates are enabled on the pbx is the reboot automatically done ? or do i need to do it everywhere?
is there a log available in the GUI to follow which updates have already been done?

Is anyone able to answer the second part of AWS2P's question, I'm specifically looking for a log for security patches in the GUI?