The latest release deployed tonight includes fixes for the following Linux kernel vulnerabilities:

• CVE-2026-98432 – MPTCP / TCP Remote Code Execution (RCE)
• CVE-2026-98548 – SCTP use-after-free (also tracked as CVE-2026-68162 and CVE-2026-64564)
• CVE-2026-99227 – io_uring / waitid

The necessary security fixes have been applied as part of our regular security patching cycle. We continue to monitor the situation and assess any potential security impact on our platform.

Level27 is aware of the vulnerability identified as CVE-2026-98432. This vulnerability has been thoroughly evaluated, and based on our current assessment, the demonstrated exploitation method does not pose any significant risk to our platform. This assessment is based on the fact that applications must explicitly request MPTCP sockets to be vulnerable, which is not something we use. However, we do recognise that applications developed in Go 1.24 and later present a higher risk, and mitigations for these are in place.

Although the underlying vulnerability affects Linux kernel TCP handling more broadly, we have assessed the exposure of our platform and have found no indication of active exploitation. Furthermore, no vendor advisories currently report any known proof-of-concept exploits or attacks in the wild.

We have developed the necessary mitigations and fixes, which will be applied to your system as part of our regular security patching cycle in the coming days.