All ColossusCloud hypervisors have been patched against CVE-2026-98432 and CVE-2026-99999. The patching work is complete across the host infrastructure behind our cloud virtual servers.
These are Linux kernel vulnerabilities. The kernel is the part of an operating system responsible for core functions such as memory management and network traffic. On a virtualization host, its security matters to the virtual machines running above it.
The host underneath your virtual server
Your VPS runs as a guest on a physical host. The hypervisor is the software that runs those guests and manages their access to the host’s resources. Our introduction to KVM virtual servers explains that relationship in more detail.
The host and guest have separate operating systems. That means a vulnerability in a Linux host can matter even when the guest is a Windows virtual server. It also means that patching the host and updating your Linux VPS operating system are separate jobs.
Why these patches matter
CVE-2026-98432 concerns how the Linux kernel handles incoming IPv4 TCP connections. A race condition, where concurrent operations interfere with each other, can cause memory to be freed while it is still being used. Crafted network requests can trigger a crash, memory corruption, or potentially remote code execution. The details are in Red Hat’s advisory for CVE-2026-98432.
CVE-2026-99999 involves insufficient validation of checksum metadata attached to network packets. On an affected host, malformed metadata sent by a local attacker or an untrusted guest can lead to memory corruption, a crash, information disclosure, or potentially code execution on the host. Red Hat’s advisory for CVE-2026-99999 describes the flaw and its impact.
We’ve applied the patches for both issues to all of our hypervisors.
Do you need to update your VPS too?
You don’t need to apply our hypervisor patches. That host maintenance is our responsibility, and the work announced here is complete.
Your guest operating system and applications still have their own update requirements. A patched host doesn’t install a new kernel or application packages inside your virtual server. If you run Linux, review your distribution’s security notices for these CVEs and follow the guidance that applies to your kernel. Don’t use this host update as confirmation that your guest is patched.
Our VPS how-to library covers server administration tasks. If you’re unsure how this announcement relates to a server in your account, ask our support team and tell us which VPS and CVE you’re checking.