Find below the content from our advisory with the mitigation measures, please follow the same. The document also describes a means of executing the hardening script (mitigation) on VOS devices using a shell script from Director shell (to help with mass update). Finally, there is an extensive FAQ section detailing the common inquiries around the CVE and its mitigation

 

Summary

Advising Vulnerability in Linux Kernel IPv4 TCP use-after-free issue - Versa Concerto, Versa Director, Versa Analytics, Versa Messaging Server, VOS, Versa OS Upgrade Orchestrator

 

Description

A use-after-free race condition occurs during IPv4 TCP connection setup (tcp_v4_syn_recv_sock), where request socket options (ireq_opt) are transferred to a child socket without proper copying. Concurrent retransmitted SYN packets can trigger memory corruption or a crash.

 

Impact

An unauthenticated remote attacker sending crafted IPv4 TCP packets can potentially cause denial of service (kernel crash), memory disclosure, or remote code execution (RCE).

 

 

Affected Versa Products

 

 

Product	Affected Versions	Mitigation Available	Description / Risks
Versa Concerto	All	Yes	CVE-2026-98432: Harden IPv4 header options by adding Iptables rules.
Versa Director	All	Yes	CVE-2026-98432: Harden IPv4 header options by adding Iptables rules.
Versa Analytics	All	Yes	CVE-2026-98432: Harden IPv4 header options by adding Iptables rules.
VOS	All	Yes	CVE-2026-98432: Harden IPv4 header options by adding Iptables rules.
Versa Messaging Server	All	Yes	CVE-2026-98432: Harden IPv4 header options by adding Iptables rules.
Versa OS Upgrade Orchestrator	All	Yes	CVE-2026-98432: Harden IPv4 header options by adding Iptables rules.

 

 

 

 

Product Impact

 

• All headend components of Versa solution, i.e., Versa Concerto, Versa Director, Versa Analytics, and Versa Messaging Server are impacted. IPv4 packets from all interfaces of these nodes are processed by the kernel. Therefore, the attacker can send malicious packets to any of the interfaces exposed on the network/Internet to exploit the vulnerability. It is recommended to apply the mitigation to all Versa nodes including Log Forwarders, Search Nodes, Analytics Nodes, Concerto Nodes, Director Nodes, OS Upgrade Orchestrator and VMS.
• This affects all versions of Linux that Versa products incorporate – Trusty/Bionic/Jammy/Noble 
• On VOS, all pass-through traffic processed by the data plane, i.e., the VNI (WAN and LAN) interfaces bypass the Linux kernel. Therefore, the attacker will not be able to exploit the vulnerability on any of the data plane / VNI interfaces. Only traffic from the out-of-band management interface (e.g., eth0) is processed by the Linux kernel. The attacker can exploit the vulnerability only if they have access to the management interface, e.g., eth0. Additionally, if any traffic from data plane is being forwarded to the Linux kernel, e.g., control traffic like BGP, an attacker could pass malicious control traffic to exploit the vulnerability. It is recommended to apply the mitigation to all VOS appliances, including Hubs, Branches, and Controllers.
• Versa components running the Trusty and Bionic kernel are not at risk for the exploit gaining root access via the Multi-Path TCP listener. Versa Trusty and Bionic systems do not support MPTCP. Versa systems that are running Jammy and Noble kernel versions are at potential risk for this root access exploit using MPTCP. 
• Versa Managed Services has mitigated Versa Hosted Components globally. Versa customers are advised to apply the mitigation and workaround for customer owned CPE devices, or any customer-owned Versa components that are at risk. 
• Versa Managed Services has mitigated Versa Titan cloud infrastructure. Versa Titan customers who require assistance or have questions for site level mitigations are advised to contact Versa Support. 

 

 

 

 

Workarounds or Mitigation

 

The following mitigations are recommended until a fixed kernel is available. These steps are intended to reduce exposure and should be applied under approved operational change control. The mitigation will install iptables rules to block any TCP packets with IPv4 options in the IP header, so that they will not be processed by the Linux kernel. 

 

 

Mitigation:

• 1. Download the hardening script below:

https://download.versa-networks.com/index.php/s/OrFx6XNKtnJHN7t 

• 2. Copy the hardening script to every Versa node in the deployment, including Versa Concerto, Versa Director, Versa Messaging Server, Versa Upgrade Orchestrator, all Versa Analytics components, and all VOS devices (Controllers, Branch, and Hub), whether physical, virtual, or cloud-based.
• 3. To apply the remediation for the vulnerability, please execute the below command on all Versa nodes:

sudo ./Install-Fix-CVE-2026-98432.sh

• To verify the status of the remediation for the vulnerability, please execute the below command on all Versa nodes:

sudo ./Install-Fix-CVE-2026-98432.sh verify

• To remove the remediation for the vulnerability, please execute the below command on all Versa nodes:

sudo ./Install-Fix-CVE-2026-98432.sh --uninstall

 

 

Permanent Fix

 

A permanent fix is in development. We have not yet confirmed a release date and will not publish one until the fix has completed validation. In the meantime, the mitigations above reduce exposure to this vulnerability, and we recommend applying them immediately. We will update this advisory with the fix status as soon as it is available and validated.

 

 

SIDE NOTE: In case you need assistance with applying the hardening script on all the VOS devices in your deployment, you can refer to the attached word document which provides the procedure to use our in-house developed shell script (you will need access to the shell/cli for your Director to execute it)

 

In summary the script would do the below

 

 

 

Additionally, below is a list of common FAQ with regards to this CVE, it impact and the mitigation

 

1. What is CVE-2026-98432?

CVE-2026-98432 is a Linux kernel IPv4 TCP use-after-free vulnerability that occurs during TCP connection establishment (tcp_v4_syn_recv_sock).

An unauthenticated remote attacker may exploit this vulnerability by sending specially crafted IPv4 TCP packets, potentially resulting in:

• Denial of Service (kernel crash)
• Memory disclosure
• Remote Code Execution (RCE), under certain conditions

2. Which Versa products are affected?

All versions of the following Versa products are identified as affected:

• Versa Operating System (VOS)
• Versa Director
• Versa Concerto
• Versa Analytics
• Versa Messaging Server (VMS)
• Versa OS Upgrade Orchestrator

All Linux distributions incorporated into these products (Trusty, Bionic, Jammy and Noble) are covered by the advisory, subject to the kernel-specific applicability described therein.

3. Is a permanent fix available?

No. A permanent kernel fix is currently under development. Versa will communicate the availability of a fixed kernel once development and validation are complete.

In the meantime, customers are advised to apply the mitigation script.

4. What does the mitigation script do?

The mitigation script, Install-Fix-CVE-2026-98432.sh, installs iptables rules to block IPv4 TCP packets containing IP header options.

It performs the following operations:

• Installs an iptables rule in the host network namespace.
• Applies the same rule to other Linux network namespaces.
• Creates system services to ensure the rules persist across reboots.
• Periodically checks for newly created network namespaces and applies the rule where required.

The script does not modify the Linux kernel or Versa application binaries.

5. Does the mitigation block all TCP traffic?

No. The mitigation specifically blocks IPv4 TCP packets containing IP header options.

Normal IPv4 TCP packets without IP header options are allowed.

Standard TCP options such as MSS, Window Scaling, Timestamps and SACK are not directly affected because these are TCP header options, not IPv4 header options.

6. Will this mitigation impact normal VOS data-plane traffic?

Normal VOS data-plane traffic processed through the DPDK forwarding path (WAN/LAN VNI interfaces) bypasses the Linux kernel and is not expected to be affected by this iptables rule.

However, traffic delivered to the Linux kernel, including management and applicable control-plane traffic, is subject to the mitigation.

7. Does this mitigation need to be applied to all VOS appliances?

Yes. Versa recommends applying the mitigation to all VOS appliances, including:

• Branch appliances
• Hub appliances
• Controllers

This applies to physical, virtual and cloud-based deployments.

8. Does the mitigation need to be applied to every Versa headend component?

Yes. Customers should apply the mitigation to all customer-owned Versa components, including:

• Director nodes
• Concerto nodes
• Analytics nodes
• Search nodes
• Log Forwarders
• Messaging Servers
• OS Upgrade Orchestrator

The mitigation should be applied to every applicable node, not just the primary node.

9. How do I install the mitigation?

Step 1: Download the mitigation script:

https://download.versa-networks.com/index.php/s/OrFx6XNKtnJHN7t

Step 2: Copy the script to each affected Versa appliance.

Step 3: Execute the following command with root privileges:

sudo bash Install-Fix-CVE-2026-98432.sh

The script installs the iptables rules and configures the necessary background services.

10. How do I verify whether the mitigation is applied?

Execute:

sudo bash Install-Fix-CVE-2026-98432.sh verify

This checks the presence of the mitigation rule across the discovered network namespaces and attempts to install missing rules.

A successful execution should report:

RESULT: PASS

11. How do I check the mitigation status without making changes?

Execute:

sudo bash Install-Fix-CVE-2026-98432.sh status

This provides a read-only report of the mitigation status across the discovered network namespaces.

12. Does the mitigation persist after a reboot?

Yes. The script creates and enables systemd services (or Upstart jobs on applicable Trusty systems) to ensure the firewall rules are reapplied during system startup.

It also periodically checks for newly created network namespaces.

13. How can I remove the mitigation?

If required, execute:

sudo bash Install-Fix-CVE-2026-98432.sh --uninstall

This removes the mitigation rules, helper script and associated services.

Note: Removal should only be performed when authorized by Versa Support/Engineering, particularly before a permanent fix is available.

14. Are Versa-hosted components affected?

Versa Managed Services has already applied the mitigation to its hosted components globally.

Versa Titan cloud infrastructure has also been mitigated. Titan customers requiring assistance with site-level mitigation should contact Versa Support.

15. Is there any special consideration for Ubuntu 14.04 (Trusty)?

Ubuntu 14.04 systems running the original 3.x kernel are not affected.

However, Trusty systems running affected 4.4-based kernels (such as linux-lts-xenial, linux-aws or linux-azure) require the mitigation.

The script uses Upstart jobs and ip netns exec for these systems instead of systemd and nsenter.

16. Does the mitigation address the additional MPTCP-related exploitation scenario mentioned in the CVE?

MPTCP (Multipath TCP) is an extension of TCP that allows a connection to use multiple network paths. It is mentioned here separately because the CVE identifies an additional potential root-level exploitation scenario involving an MPTCP listener on newer Linux kernels (Ubuntu 22.04/Jammy and Ubuntu 24.04/Noble).Please note that Versa components running the Trusty and Bionic kernel are not at risk for the exploit gaining root access via the Multi-Path TCP (MPTCP) listener. Versa Trusty and Bionic systems do not support MPTCP. Versa systems that are running Jammy and Noble kernel versions are at potential risk for this root access exploit using MPTCP - however the use of the hardening script mitigates this exploit to a large extent.

17. Is a downtime needed while executing the hardening script?

We don't expect any service impact while executing the hardening script (it just adds a statement the iptables to block the tcp sessions incoming with "ip options" field). It does not trigger any restart or reboot, and should not affect the services or data-plane in any way. However you can do this in a controlled maintenance window (though we don't deem that there would be any downtime)

 

FAQ on the script for Mass deployment/installation of hardening script on VOS through Versa Director

1. Do VOS devices need to be in sync with Director to execute the mitigation deployment script?

No.

The Director-based deployment script uses direct SSH/SCP connectivity to transfer and execute the mitigation script on VOS appliances.

It does not depend on Director's configuration synchronization or template deployment mechanism.

2. Will the deployment script work on devices that are Template Out-of-Sync or Config Out-of-Sync?

Yes.

Devices showing Template Out-of-Sync or Config Out-of-Sync status can also be processed, provided the required SSH/SCP connectivity and administrative access are available.

The deployment script does not check or depend on the device's configuration synchronization status.

3. What are the prerequisites for successful deployment through Director?

The following conditions must be met:

• VOS appliances must be reachable from Director over SSH.
• SSH/SCP connectivity must be permitted between Director and the VOS appliances.
• The admin account and SSH key-based authentication must be functional.
• The sudo password supplied during execution must be valid.
• All intended devices must be included in the host_names.txt input file.

4. What happens if a device is unreachable or deployment fails?

The deployment script processes devices individually and maintains a summary of successful and failed executions.

Devices that cannot be reached, have SSH/SCP connectivity issues, or encounter installation errors are reported in the failure summary for further investigation.

5. Does configuration synchronization need to be performed after installing the mitigation?

No.

The mitigation is installed directly at the Linux OS level and does not involve changes to the VOS configuration database, templates or configuration deployment mechanism.

Therefore, no configuration synchronization or template deployment is required as part of this mitigation process.

6. What happens if a device is missing from the deployment input file?

The Director-based deployment script processes only the devices listed in host_names.txt.

Any device missing from this file will not be processed and must be added before executing the deployment again.

 

 

NOTE: We have published the advisory of for CVE-2026-98432 in our security portal (link below for reference), please do login to this portal and click on "follow"  to be notified of these announcements in the future