IPFire has released an emergency Core Update 205 to address a critical vulnerability (CVE-2026-98432) in the Linux kernel's TCP stack, which allows remote root access without credentials. The update includes a new kernel version (6.18.60) and a fix for a Broadcom network driver crash, but it requires a mandatory reboot to take effect. While the original feature set planned for CU205 has been postponed to the upcoming Core Update 206, the urgency of patching the critical flaw necessitated a focused release. Users are encouraged to apply the update immediately to mitigate the risk, as the vulnerability has been publicly disclosed and is actively being exploited

IPFire Core Update 205 Patches Critical Linux Kernel TCP Flaw

IPFire has shipped Core Update 205 as an emergency release, fast-tracking a patch for CVE-2026-98432, a critical (9.8) use-after-free vulnerability in the Linux kernel's TCP stack. The update carries only a new kernel (6.18.60) plus a fix for a Broadcom network driver crash, and it requires a reboot to take effect. The flaw, reported by Anthropic, lets an attacker gain root access remotely with no credentials, which prompted warnings of active exploitation. Meanwhile, the broader feature set originally planned for CU205 was relocated to Core Update 206, now available in the testing channel.

IPFire Core Update 205 Patches Critical Linux Kernel TCP Flaw @ Linux Compatible