Security alert: check and reboot your TurnKey servers

A serious Linux kernel vulnerability, CVE-2026-98432, can allow an attacker to take control of an affected server over the network, without a password or any action by its users.

Security fixes are available for TurnKey Linux 18 and 19. TurnKey’s automatic security updates may have already installed the fix on your server. A reboot activates the updated kernel.

Please check every TurnKey server you manage using the instructions below.

Why this matters

The kernel is the core of the operating system. It controls memory, hardware and network connections.

Researchers demonstrated an attack that gives someone connecting over the network full administrator access. An attacker with that access could steal databases and credentials, alter or delete files, install malicious software, or use the server to attack other systems. The vulnerability can also cause crashes and expose information from memory. AWS security advisory

The demonstrated attack used a networking feature called Multipath TCP. The underlying flaw affects TCP handling more broadly, so all affected servers should receive the update. Akamai’s technical analysis

Are attackers exploiting it?

Researchers reported a successful remote takeover on 27 October. AWS’s advisory, updated on 6 November, reported no observed exploitation. The ability to take over a server remotely makes this an urgent update, especially for servers accessible over the internet. Research disclosure, AWS advisory

1. Check your running kernel

Open your server’s console or connect through SSH and enter:

uname -v

Look for the version immediately after Debian. For example:

... Debian 6.12.116-1 (...)

If your running kernel meets the version listed above, your server is patched for this vulnerability.

Some TurnKey 18 installations use Debian’s alternative 6.12 kernel. Those need 6.12.113-1~deb12u1 or a later version in that series. For other kernels, ask your hosting provider or our community forum to check your output. These versions come from Debian’s security tracker.

Proxmox and LXC users: your container shares its host’s kernel. Ask the host administrator to update and reboot the host using its vendor’s instructions.

2. If your running kernel is older, reboot

TurnKey installs security updates automatically by default. Your patched kernel may already be installed and waiting for a reboot.

Make sure you have a recent backup and allow for a brief interruption while the server restarts. Log in as root and run:

reboot

Your SSH connection will close. Once the server is back, reconnect and run uname -v again. If it meets the version above, the fix is active. Check that your application works as expected.

3. If the kernel is still older, install security updates

As root, run:

turnkey-install-security-updates

Wait for the updates to finish successfully, then run:

reboot

Reconnect, repeat the uname -v check, and test your application.

If the update reports errors or your server still boots an older kernel, ask for help. Include your TurnKey version, the uname -v output and any error messages.

Running TurnKey 17 or earlier? Upgrade urgently

TurnKey 18 is based on Debian 12, which receives long-term security support until June 2028. TurnKey 19 uses Debian 13. Both have a fix for this vulnerability.

Debian 11, the base for TurnKey 17, reached the end of its normal long-term support on 31 August 2026. Continued Debian 11 security coverage requires separately arranged extended support. Move older installations to a current, supported TurnKey release as soon as possible. Debian 12 support, Debian 11 support

Keep your applications and plugins updated alongside the operating system. Some applications have their own upgrade process; follow the instructions for your app.

If your server has been compromised

Isolate the server and rebuild it from a trusted, current TurnKey image. Apply security updates to the fresh installation and replace exposed passwords, API keys and other credentials from a trusted device.

TurnKey Backup and Migration (TKLBAM) makes rebuilding easier. It backs up the changes you’ve made to the original TurnKey system, including your data, configuration and package selections. You can restore those changes onto a fresh installation of the same TurnKey app. Migration between major versions may require extra steps for your application.

Choose a backup from before the compromise and review the files and configuration you restore. A backup taken after an intrusion can include the attacker’s changes. If the intrusion date is uncertain, get help reviewing the data before restoring it.

If you have a paid TurnKey Hub plan, you can contact us for help. Use support inside the Hub, or email support@turnkeylinux.org from the address associated with your Hub account.