Proxmox PSAs: kernel UAF/leak & component permission flaws

Summary of Key Information in Proxmox Security Advisories Overview This page summarizes multiple Proxmox security advisories (PSAs) affecting components such as the kernel, qemu-server, pve-manager, and libpve-access-control. The issues include local privilege escalation, memory leaks, missing parameter validation, incomplete permission checks, and authentication bypass. Detailed Vulnerability Information 1. PSA-2026-00037-1: SCTPhantom Local Privilege Escalation Affected Components: Issue: A use-after-free vulnerability in the Linux kernel's SCTP module allows an unprivileged local attacker to gain root privileges or even escape from an unprivileged container. Mitigations/Fixes: - Preventive measure: Remove the module from the list of loaded system modules. - Fixed versions: - (signed, Trixie-based products) - (signed, Bookworm-based products) Reference: CVE-2026-64564 2. PSA-2026-00038-1: TONTU Kernel Memory Leak (Branch Predictor Retransmission) Affected Components: Issue: A newly discovered branch predictor retransmission technique can leak kernel memory during the window between neutralization and execution return. This issue affects only AMD and Intel CPUs. Fixed Versions: - (signed, Trixie-based) - (signed, Bookworm-based) Reference: CVE-2026-68480 3. PSA-2026-00039-1: Missing Parameter Validation in Remote Migration Affected Components: Issue: The remote migration code lacks parameter validation. An attacker with the privilege can inject arbitrary values into the QEMU commands of the migration target. Fixed Versions: - (PVE 9.x) - (PVE 8.x) 4. PSA-2026-0040-1: Incomplete Permission Check for Unused Volumes Affected Components: , Issue: The permission check for adding unused volumes to a guest is incomplete, allowing access to volumes that fall outside the scope of the userAPI token. Fixed Versions: - (PVE 9.x) - (PVE 9.x) - (PVE 8.x) - (PVE 8.x) 5. PSA-2026-0042-1: Missing Permission Check in vdump Stop API Affected Components: Issue: Any authenticated user or API token can trigger the stopping of a running backup. Fixed Versions: - (PVE 9.x) - (PVE 8.x) 6. PSA-2026-0043-1: Authentication Bypass in End-of-Life Proxmox VE 7 Affected Components: Affected Versions: through (corresponding to the Proxmox VE 7.0 and 7.x lifecycle, including 7.4 which reached End-of-Life in July 2024) Issue: The API login endpoint (POST ) accepts a parameter, carrying a signed semi-authenticated TFA challenge ticket. In the affected versions, this parameter is not validated for users who have two-factor authentication (2FA) configured, allowing the submitted password to be entirely skipped. This enables attackers to bypass authentication to access the API (port 8006), either directly or via a reverse proxy. Fixed Versions: (released on 2023-07-20) and later. Unsupported Proxmox VE 7 versions are unaffected (already EOL). Timeline: The vulnerable code path has existed since 2023 but was not identified as a candidate for fixing. Recently, multiple independent reports (by Kumar Rajkumar, Nathan Xavier Goler, Sagrik Saamla, and others) confirmed the issue. Mitigations: - For sites unable to upgrade immediately: Add a validation step to the affected path to ensure the value is a valid signed TFA challenge ticket. - The only reliable fix is to upgrade to a supported version of Proxmox VE (the affected versions are EOL and will not receive further security updates). PoC / Exploit Code (Full Extraction) > Note: The grep command must output (indicating that appears 3 times in the file). If it outputs a different value, the patch has not been applied correctly; restore the backup file and restart the two services.

Goal Reached Thanks to every supporter — we hit 100%!

Proxmox PSAs: kernel UAF/leak & component permission flaws