Please upgrade your kernel to fix CVE-2026-98432

General Discussion
1

Please upgrade your kernel via sudo apt update; sudo apt upgrade and reboot, to fix the critical vulnerability CVE-2026-98432: https://nvd.nist.gov/vuln/detail/cve-2026-98432

We pushed updates for all kernel packages we build, and Debian did so some days ago, thanks to being informed before it was made public.

For Raspberry Pi users: A kernel package update is still outstanding, but should follow soon: https://forums.raspberrypi.com/viewtopic.php?t=401496

3

Are you sure about that? I am seeing no patch for the raspi-v8…

4

See my last sentence.

5

This one, a task for RPI developer, nothing we can influence

6

I have a Rock 5B with vendor kernel installed. Does the following kernel package fix the problem?:

linux-image-vendor-rk35xx/all,now 26.11.0-trunk-dietpi2

7

If its the one available since a day, yes

8

I have a question about this:

Since the kernel upgrade for the Raspberry Pi still isn’t available, I’m starting to get a little impatient. (I know that’s not your fault :wink:)

So, in a moment of recklessness, I tried running `rpi-update`, and it installed kernel 6.18.59-xxx.

I did this on 3 of my many Pi’s. It worked without any problems, except for a message that made me a little unsure.

It says that the FAT partition should be 256MB; otherwise, some systems might not boot anymore.

Now I’ve checked several Pi’s, and the FAT partition is actually only 128MB.

But on two systems with 128 MB, where I hastily updated the kernel using `rpi-update`, the system has been running flawlessly so far. Was that just luck, or how should I interpret this?

I’m aware that `rpi-update` probably isn’t the best method, but what should I do now?

9

As we don’t maintain the RPi kernel, nothing we can do from our side and you would need to wait on RPi developer to provide an official kernel version.

Using RPi own tools is fine but be aware, you are using them in your own risk. Because you installed a kernel in development state. At least not released as stable version.

The warning about file system size can be ignored I guess

10

Yes, this is the vendor kernel build which has the fix, for all RK3588 boards. Newer RK3588 images use the mainline kernel package linux-image-current-rockchip64, where the fixed version 26.11.0-trunk-dietpi2 is the same.

Generally, I’d recommend using the beta component instead:

cat << '_EOF_' | sudo tee /etc/apt/preferences.d/raspi-beta
Package: *
Pin: release o=Raspberry Pi Foundation, c=beta
Pin-Priority: -1

Package: linux-image-*
Pin: release o=Raspberry Pi Foundation, c=beta
Pin-Priority: 100
_EOF_
echo "deb https://archive.raspberrypi.com/debian ${G_DISTRO_NAME/forky/trixie} beta" | sudo tee /etc/apt/sources.list.d/raspi-beta.list
apt update
apt upgrade

rpi-update installs files to different locations, so there will be stray files around. The 256 MiB warning can be ignored. There should be still only ever one kernel and initramfs copied to the boot partition. Check via df /boot/firmware it it is any close.