All Linux servers without the CVE-2026-98432 patch are affected and must be patched. This procedure covers Debian 12 and Debian 13 hosts: install the fixed kernel, reboot, verify the running kernel, then confirm that calls work.

Cloud environments: Our cloud environments will be patched shortly.

Required kernel versions

These fixes are listed in the Debian security tracker. A later vendor kernel that includes the fix is also acceptable. Servers on other Linux distributions require their vendor’s patched kernel; the commands below apply to Debian.

Before patching

Schedule the reboot and drain traffic or active calls from the host as appropriate. Patch one host at a time where redundancy allows. Ensure console access is available if the host does not return after reboot, and retain the previous kernel for recovery.

Record the OS, current kernel and expected containers:

cat /etc/os-release
uname -r
uname -v
dpkg --print-architecture

For Docker hosts, record the container list before reboot:

sudo docker ps -a

Use the equivalent inventory command if the host uses another container runtime.

1 Install the updated Debian kernel

Refresh package information from the host’s configured Debian repositories, including the security repository:

sudo apt update

Use the kernel metapackage matching the host’s architecture and existing kernel flavour. For a standard amd64 host:

apt-cache policy linux-image-amd64
sudo apt install linux-image-amd64

For an amd64 host already using the Debian cloud kernel, use linux-image-cloud-amd64 instead. Other architectures or kernel flavours require their corresponding metapackage. If the host requires DKMS modules, update the matching kernel headers and confirm the modules build successfully.

Review the installed kernel image package versions:

dpkg-query -W -f='${Package}\t${Version}\t${db:Status-Status}\n' 'linux-image-[0-9]*'

Confirm that an installed image contains the fix for the host’s Debian release. Debian image names and uname -r can use an ABI identifier that differs from the upstream version; compare the package version with the table above.

If the fixed version is unavailable, check security repository configuration, package holds and repository pinning before proceeding. Resolve installation, initramfs, bootloader or module build errors before rebooting.

2 Reboot the host

Once installation finishes successfully and traffic has been drained:

sudo reboot

Reconnect after the host returns. Installing a kernel alone does not switch the running kernel.

3 Check that the new kernel is running

Run these commands on the host, outside any container:

uname -r
uname -v
dpkg-query -W -f='${Package}\t${Version}\n' "linux-image-$(uname -r)"

Confirm that the package owning the running kernel is the patched version for this release, or a later version containing the fix. If the old kernel is still running, check bootloader selection and boot errors, correct the issue and reboot again. Keep the host marked as unpatched until this check passes.

4 Container stack Check containers and make a test call

Confirm that every expected container is running and that configured health checks pass. For Docker:

sudo systemctl status docker --no-pager
sudo docker ps -a

Make a test call through the normal service path. Confirm that it connects, audio works in both directions and the call ends normally. Investigate any errors before returning the host to normal service.

4 Old System Architecture

Make a test call through the normal service path. Confirm that it connects, audio works in both directions and the call ends normally. Investigate any errors before returning the host to normal service.

Recovery

If the host fails to boot, use console access to select the previous kernel and restore service. A host recovered onto an unpatched kernel remains affected and needs follow-up remediation. If containers or the test call fail, keep traffic drained where possible and investigate before proceeding to the next host.

Vulnerability reference

CVE-2026-98432 in the National Vulnerability Database

Debian fixed package versions