Skip to content

Kernel Security Updates

Appliku checks the Linux kernel of your servers for CVE-2026-98432, a use-after-free in the IPv4 TCP code of the Linux kernel. An attacker can trigger it over the network without credentials. The fix is a new kernel from your distribution, and the server must reboot to run it.

How Appliku Shows the Status

Appliku reads the kernel version of each active server when it fetches the server stats (every few minutes, and when you click Refresh Stats or Fetch all stats). A server can be:

Status Meaning What you see
Vulnerable A fixed kernel exists for the server's OS, but the server does not run it. A red triangle on the server list and on the cluster node list, and a red Security update (CVE-2026-98432) button on the server page and on the server card of the app overview.
No fix The server runs Ubuntu 20.04, 18.04 or 16.04. No fixed kernel exists for these releases. A red triangle and a red Security issue (CVE-2026-98432) button.
OK The server runs a fixed kernel. Nothing.
Unknown Appliku cannot tell, for example for a kernel flavour or version that it does not know, or when the stats fetch failed. Nothing.

No warning does not prove that a server is safe. For a server with an unknown status, compare its kernel (uname -r, or Kernel on the server page) with the security notice of your distribution.

When at least one active server of the team is vulnerable or has no fix, the top bar shows a red button Security issue: N server(s) (CVE-2026-98432). It opens the server list.

Install the Fixed Kernel

Team owners and admins can patch a vulnerable server:

  1. Click Security update (CVE-2026-98432) on the server page (or on the server card of the app overview). The Run tab of the server opens.
  2. On the card Security update: CVE-2026-98432 (Linux kernel TCP), click Patch kernel & reboot and confirm.
  3. Follow the progress in the log below the card.

The job:

  1. Installs the distribution's kernel package for the server (for example linux-image-generic, or linux-image-aws on EC2) with apt-get. It first does a dry run and stops if the install would remove other packages.
  2. Checks that the server can boot the new kernel: free space in /boot, an initramfs for the new kernel and an older kernel to fall back to.
  3. Reboots the server and waits up to 8 minutes for it to come back.
  4. Checks that the new kernel runs. The log then shows +++ REMEDIATED.

If the server already runs a fixed kernel, the job says so and does not reboot. If a check before the reboot fails, the job stops without a reboot and the log says why. If the server does not come back in time or does not run the fixed kernel after the reboot, the job reports a failure; check the server. On Debian, the security source (security.debian.org) must be enabled in apt, because the fixed kernel is only there.

Only one patch job can run on a server at a time.

Downtime

The reboot stops all apps and databases on the server for a short time, usually one to a few minutes. Appliku does not move or stop them before the reboot. Run the update at a quiet time, and check that your apps and databases run again when the server is back.

Cluster Nodes

The patch works on cluster nodes too. During the reboot the node leaves the Swarm for a short time, and Docker Swarm moves its tasks to other nodes. Patch the nodes of a cluster one at a time: wait until a node is back and the job reports success before you start the next one. A single-node cluster is down during the reboot.

Servers Without a Fix (Ubuntu 20.04 and Older)

Ubuntu 20.04 and older releases no longer get standard security updates, so there is no kernel patch for them. Create a new server with Ubuntu 24.04 or 26.04, move your apps and databases to it, then delete the old server.

New Servers

New servers install the latest kernel during the server setup. Servers that Appliku creates at DigitalOcean, AWS EC2 or Hetzner Cloud try to reboot into the new kernel at the end of the setup. The reboot can be skipped (for example when Appliku cannot read the kernel state), so check the status on the server page after the setup.