We are releasing IPFire 2.29 - Core Update 205 immediately as an emergency update. Please install it as soon as possible.
Security fix
This update fixes CVE-2026-98432, a serious use-after-free vulnerability in the Linux kernel's TCP stack. Because the flaw is in the network stack that every IPFire system relies on, we strongly recommend that you do not wait for your next maintenance window.
Other changes
Core Update 205 ships only a new Linux kernel, updated to 6.18.60. Besides the fix for CVE-2026-98432, it fixes a crash in the Broadcom network driver.
A reboot is required
Since the kernel is replaced, this update requires a reboot. The fixes only take effect after you have rebooted your system, so please do not skip this step.
You can install the update from the web user interface or with pakfire as usual.
What happened to the previous Core Update 205?
The changes that were previously planned for Core Update 205 have been moved to Core Update 206, which is now out for testing. Thank you to everyone who is helping to test it.
Please support IPFire
IPFire is free and open source, and it is maintained by a small team. Emergency releases like this one are only possible because people and companies keep the project going. If you rely on IPFire, please consider becoming a sponsor.
Thank you for using IPFire, and please update today.
More...
