Hey,

On Saturday, Oct 31, one of our customers opened a support request about CVE-2026-98432, a critical bug in the Linux kernel's IPv4 TCP code (a use-after-free that a remote attacker can trigger with crafted packets). There is a good public write-up here if you want the details.

The short version: it is already mitigated on every Quave ONE node, and you don't need to do anything.

What we did

Ubuntu, the OS our nodes run, has not published a patched kernel yet, so we couldn't just update and move on. Instead, on Sunday, Nov 1, between 23:00 and 00:00 UTC, we applied a mitigation to all nodes in all regions:

• we drop incoming IPv4 TCP packets that carry IP options, which is the traffic the bug needs, and normal traffic doesn't use them;
• we turned off a kernel feature that the known exploit depends on.

Both changes survive reboots, and we applied them without restarting any node, so your apps didn't notice. We also tested it from the outside on the public ingress: a normal connection works, and a connection carrying IP options is dropped.

What comes next

This is a mitigation, not the final fix. When Ubuntu releases the patched kernel, we will update the nodes and restart them one at a time, and we will post it on our status page before we start and when it's done. We are not going to send an email for each step, so subscribe to the status page (the "Subscribe to updates" button at the top) to get these notices, it's the only way to be sure you will see them. If your app has a time when a restart would hurt, reply to this email and tell us, we will plan around it.

Please tell us when you see something like this

This one reached us because a customer sent it to us, and that was great. Security issues like this are now showing up almost every week, and we watch for them, but more eyes are better than fewer.

So, if you see a CVE or any security issue that you think could affect your app or our infrastructure, always contact us. Open a support request in the app or reply to this email, even if you are not sure it matters. We prefer to check ten false alarms than miss one real problem.

Thanks for helping us keep everyone safe :)

Filipe