We’ve patched all of our hypervisors against CVE-2026-98432 and CVE-2026-99999. This work is complete on the ColossusCloud platform that powers ServerPoint’s VPS hosting services.
A hypervisor is the software on a physical host that runs virtual machines. Your VPS has its own operating system, while the hypervisor manages the virtual machines underneath it. These patches address that host layer.
What the two vulnerabilities affect
Both vulnerabilities are in the Linux kernel, the core of the operating system that handles tasks such as memory and networking. They affect different parts of IPv4 network processing:
- CVE-2026-98432: A memory-handling flaw during TCP connection setup can let specially timed network requests cause a host crash, memory corruption, or potentially remote code execution. Red Hat’s CVE-2026-98432 advisory explains the issue.
- CVE-2026-99999: Incorrect validation of packet checksum metadata can corrupt memory. A local attacker or an untrusted guest virtual machine that can send those packets into an affected host could cause a crash, disclose memory, or potentially execute code on the host. See Red Hat’s CVE-2026-99999 advisory for the technical details.
Host security matters because a hypervisor sits underneath the virtual machines it runs. If you’d like more background, our explanation of KVM virtualization describes how that layer works.
What this means for your VPS
The hypervisor patching is complete. You don’t need to install these host patches yourself; we manage the infrastructure underneath your virtual server.
This host-layer update applies whether you use a Linux virtual server or a Windows VPS. A Windows guest still runs on a hypervisor, so the operating system inside your VPS doesn’t determine whether host maintenance matters.
Your operating system has its own updates
Patching a hypervisor doesn’t update the operating system or applications inside a VPS. Those are separate layers, with separate security updates.
If you administer a Linux VPS, check your distribution’s advisories for these CVEs and follow its guidance for your installed kernel. This announcement confirms our hypervisor patching; it doesn’t establish the patch status of the operating system inside your VPS. Our server administration how-to guides provide background on managing your server.
If you have questions about this update or need help understanding which layer a security advisory concerns, contact our support team and include the CVE number and the VPS you’re asking about.