Overview
On 15 October 2026, a vulnerability in the Linux kernel was published as CVE-2026-98432 (CVSS 3.1 base score 9.8, Critical). The issue is a use-after-free in the kernel's IPv4 TCP connection handling: a remote, unauthenticated attacker who sends specially timed TCP connection requests could cause a system crash (denial of service), memory corruption, or, in theory, remote code execution.
The Parallels RAS High Availability Load Balancing (HALB) appliance runs a Linux kernel. Our engineering team has confirmed that the kernel in the previous HALB appliance images is within the affected range. For example, the HALB v22.0 appliance (before Hotfix 1) ships with Linux kernel 6.12.91; the fix is included in kernel 6.12.113 and later. Because of this, security scanners may flag HALB appliances. At the time of writing, Parallels is not aware of any customer being affected by an exploit.
Parallels has released hotfix HALB appliances for RAS 22.0 and RAS 21.2. These appliances are built on an updated base operating system that includes the patched kernel. Other RAS components that run on Windows (RAS Connection Broker, Secure Gateway, RD Session Host agents, and so on) do not use the Linux kernel and are not affected by this CVE.
Current status
| HALB version | Fixed build | Status |
|---|---|---|
| HALB 22.0 | HALB 22.0.0 Hotfix 1 (v22.0.0.1-28161) |
Released |
| HALB 21.2 | HALB 21.2.2 Hotfix 3 (v21.2.2.3-27435) |
Released |
| HALB 20.2 | None. HALB 20.2 is based on an older operating system release that no longer receives security updates from its vendor. | Not planned — upgrade to HALB 21.2.2 Hotfix 3 or HALB 22.0.0 Hotfix 1 (see Recommended action) |
Recommended action
- RAS 22.0 Farms: replace your HALB appliances with HALB 22.0.0 Hotfix 1 (
v22.0.0.1-28161). - RAS 21.2 Farms: replace your HALB appliances with HALB 21.2.2 Hotfix 3 (
v21.2.2.3-27435) or HALB 22.0.0 Hotfix 1. - RAS 20.2 Farms: upgrade your HALB appliances to HALB 21.2.2 Hotfix 3 or HALB 22.0.0 Hotfix 1. No hotfix is planned for HALB 20.2.
- Older, unsupported versions: we recommend that you upgrade to a supported version.
Important: HALB is backward compatible. You do not need to upgrade your RAS Farm to install a newer HALB appliance. RAS 21.2 Farms can use HALB 22.0.0 Hotfix 1, and RAS 20.2 Farms can use HALB 21.2.2 Hotfix 3 or HALB 22.0.0 Hotfix 1.
Download the HALB appliance from Parallels RAS download links.
Until you can update
No configuration workaround is available for the HALB appliance. To reduce exposure until you install the hotfix, make sure that the HALB appliances can be reached only on the ports required for load balancing, and that their management interfaces are not exposed to untrusted networks.
Was this article helpful?
Tell us how we can improve it.