We have finished the November update of our Linux images. The new images carry packages up to date as of November 10, and their kernels include the fix for CVE-2026-98432, the critical vulnerability described in our October 31 announcement. New and reinstalled VPSs use the new images; running VPSs do not change on their own, so please see Part 2 for what to do.
1. What has changed
Kernel versions in the new images:
Ubuntu 22.04: 5.15.0-203
Ubuntu 24.04: 6.8.0-149
Ubuntu 26.04: 7.0.0-43
Debian 12: 6.1.190
Debian 13: 6.12.116
Rocky Linux 8 and AlmaLinux 8: 4.18.0-553.184.1
Rocky Linux 9 and AlmaLinux 9: 5.14.0-687.66.1
CentOS Stream 9: 5.14.0-763
Networking: BBR congestion control and the FQ queue are on by default, and the TCP send and receive buffers are larger, so a single connection over long distances, such as from mainland China or elsewhere in Asia, can reach higher speeds.
Security: only the SSH port is open to the internet, and the system no longer listens on any other public port. MPTCP is off, as are DCCP, SCTP, RDS and TIPC, network protocols that are rarely needed but often used for privilege escalation. ICMP redirects and source routing are not accepted.
Leaner system: components a cloud server does not need, such as snap, crash reporting and hardware firmware updates, have been removed, and each image keeps a single kernel. Automatic security updates now run at a random time of day on each server.
The CentOS 7.9 and CentOS Stream 8 images now use the official archive repositories; see Part 3.
2. What we recommend
For a running VPS, choose either option below.
Option 1: Reinstall
Reinstall your VPS from the client area and choose the same operating system. After the reinstall it runs the new kernel listed above. A reinstall erases everything on the system disk, so please back up any files you want to keep first.
Option 2: Upgrade the kernel and reboot, without reinstalling
Log in to your VPS as root, paste the line for your system into the SSH terminal and press Enter. The system upgrades and reboots on its own; log back in after 3–5 minutes.
Ubuntu and Debian:
apt-get update && apt-get full-upgrade -y && rebootRocky Linux, AlmaLinux and CentOS Stream 9:
dnf upgrade --refresh -y && rebootOn Ubuntu 24.04, automatic updates do not install this kernel yet, so please run the command once by hand. On the other systems, a kernel that automatic updates have already installed only takes effect after a reboot.
If you prefer to go one step at a time:
(1) Check which system you are running:
cat /etc/os-release | head -n 2(2) Refresh the package lists (skip this step on Rocky Linux, AlmaLinux and CentOS Stream 9):
apt-get update(3) Upgrade all packages, including the kernel. Run the first line on Ubuntu or Debian, the second on Rocky Linux, AlmaLinux or CentOS Stream 9:
apt-get full-upgrade -y
dnf upgrade --refresh -y(4) Reboot to load the new kernel:
reboot(5) Log back in and check the kernel version:
uname -rvYour server is fixed if the kernel is in the same series as below and its number is at least: Ubuntu 22.04 5.15.0-203, Ubuntu 24.04 6.8.0-149, Ubuntu 26.04 7.0.0-43, Debian 12 6.1.190 (the number after "Debian" in the output), Debian 13 6.12.113, Rocky Linux / AlmaLinux 8 4.18.0-553.182.1, Rocky Linux / AlmaLinux 9 5.14.0-687.64.1, CentOS Stream 9 5.14.0-763. If you enabled the temporary protection from our October 31 announcement, you can leave it in place.
3. Notes for CentOS users
The new CentOS 7.9 and CentOS Stream 8 images point to the official archive repositories (vault.centos.org), so yum and dnf can install software right away without any repository changes on your side. CentOS Stream 9 is still maintained upstream until the end of May 2027 and uses the official repositories; this vulnerability is fixed in kernel 5.14.0-763, so the dnf command in Part 2 is all you need.
CentOS 7 and CentOS Stream 8 have reached end of life. They receive no more security updates, many published vulnerabilities will stay unfixed, and our images cannot fix them either. CentOS Stream 9 is a rolling preview release with only about six months of maintenance left. We do not recommend choosing CentOS any more; for new projects, Rocky Linux or AlmaLinux (which work much like CentOS), Debian or Ubuntu are better choices. As for CVE-2026-98432, CentOS 7 is not affected, while CentOS Stream 8 is affected and will not receive an official fix.
If your workload must stay on CentOS, you can choose for yourself:
(1) Keep your current system, or reinstall with the new image (archive repositories already set up), and accept the risk of the unfixed vulnerabilities.
(2) Install a community-maintained third-party kernel, such as the long-term kernel-lt from ELRepo, and see whether it fixes the vulnerabilities you care about. It is not an official CentOS kernel; some software may stop working or the server may fail to boot, so this is at your own risk and you should back up first. CentOS 7 no longer has a maintained community kernel.
In the long run, we still recommend moving to a maintained system such as Rocky Linux or AlmaLinux. They work much like CentOS, and community migration tools can usually convert an existing system in place without a reinstall. Please look into the method that suits you and back up before migrating.
Thank you for your business,
NovixLink
