Overview
On 15 October 2026, a vulnerability in the Linux kernel was published as CVE-2026-98432 (CVSS 3.1 base score 9.8, Critical). The issue is a use-after-free in the kernel's IPv4 TCP connection handling: a remote, unauthenticated attacker who sends specially timed TCP connection requests could cause a system crash (denial of service), memory corruption, or, in theory, remote code execution.
The Parallels RAS High Availability Load Balancing (HALB) appliance runs a Linux kernel. Our engineering team has confirmed that the kernel in the current HALB appliance images is within the affected range. For example, the HALB v22.0 appliance ships with Linux kernel 6.12.91; the fix is included in kernel 6.12.113 and later. Because of this, security scanners may flag HALB appliances. At the time of writing, Parallels is not aware of any customer being affected by an exploit.
We are releasing hotfix HALB appliances, which include the patched kernel. Other RAS components that run on Windows (RAS Connection Broker, Secure Gateway, RD Session Host agents, and so on) do not use the Linux kernel and are not affected by this CVE.
Current status
| HALB version | Scope | Status |
|---|---|---|
| HALB 22.0 | Appliance updated with a patched Linux kernel. | In progress — HALB 22.0.0 Hotfix 1 in testing, release expected shortly |
| HALB 21.2 | Appliance updated with a patched Linux kernel. | Planned — HALB 21.2.2 Hotfix 3 to follow the 22.0 release |
| HALB 20.2 | HALB 20.2 is based on an older operating system release that no longer receives security updates from its vendor. No hotfix is planned for HALB 20.2. | Not planned — upgrade to HALB 21.2.2 Hotfix 3 or HALB 22.0.0 Hotfix 1 (see Recommended action) |
This article will be updated with build numbers and download links as each hotfix is released.
Recommended action
- RAS 22.0 Farms: when HALB 22.0.0 Hotfix 1 is released, replace your HALB appliances with the hotfix appliance.
- RAS 21.2 Farms: deploy HALB 22.0.0 Hotfix 1 as soon as it is available, or HALB 21.2.2 Hotfix 3 when it is released.
- RAS 20.2 Farms: upgrade your HALB appliances to HALB 21.2.2 Hotfix 3 or HALB 22.0.0 Hotfix 1. No hotfix is planned for HALB 20.2.
- Older, unsupported versions: we recommend that you upgrade to a supported version.
Important: HALB is backward compatible. You do not need to upgrade your RAS Farm to install a newer HALB appliance. RAS 21.2 Farms can use HALB 22.0.0 Hotfix 1, and RAS 20.2 Farms can use HALB 21.2.2 Hotfix 3 or HALB 22.0.0 Hotfix 1.
Download the HALB appliance from Parallels RAS download links.
Until you can update
No configuration workaround is available for the HALB appliance. To reduce exposure until you install the hotfix, make sure that the HALB appliances can be reached only on the ports required for load balancing, and that their management interfaces are not exposed to untrusted networks.
Was this article helpful?
Tell us how we can improve it.