Black october in cybersecurity and LogMan.io¶

October 2026 has been an unusually heavy month for security. Two events matter directly for LogMan.io operators: a critical vulnerability in the Linux kernel, and a supply-chain incident in third-party components that forced emergency LogMan.io releases.

The practical takeaway is short: patch the host kernel on every LogMan.io deployment, and plan an upgrade to the upcoming emergency LogMan.io release.

CVE-2026-98432 — critical Linux kernel vulnerability¶

CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP SYN/SYNACK handling. The kernel frees inet_opt / ireq_opt with a plain kfree() instead of kfree_rcu(), so a retransmitted SYN can race with child-socket teardown. The vulnerability was published on 2026-10-15 and carries CVSS 9.8 (CVSS 3.1) / 8.3 (CVSS 4.0). It is remotely triggerable with no privileges and can lead to kernel memory corruption affecting confidentiality, integrity, and availability.

Impact on LogMan.io¶

LogMan.io software itself is not affected — no LogMan.io component is involved in the vulnerable code path. The exposure comes entirely from the host Linux kernel: any LogMan.io deployment (bare metal, VM, or LXC containers, which share the host kernel) is vulnerable if its host kernel is in the affected range. Our internal test environment runs a kernel in the affected range and is also exposed. Treat all production hosts as affected until patched.

Verify MPTCP sockets on a host (the vulnerable code path)¶

The following commands check whether the vulnerable MPTCP code path is reachable on a host:

sysctl net.mptcp.enabled          # 1 = MPTCP enabled in the kernel
ss -M -a                          # sockets with Netid "mptcp" = MPTCP in use
cat /proc/net/mptcp               # present = MPTCP in use; absent = none
grep -i mptcp /proc/net/protocols
ip mptcp endpoint show            # subflow / add_addr_accepted counters

Caveat: on kernels older than 5.16 (for example Ubuntu 22.04's 5.15), ss -M can fall back to listing plain TCP sockets. Cross-check the Netid column — it must read mptcp, not tcp — and confirm /proc/net/mptcp is absent when no MPTCP is in use.

Action required¶

The Linux kernel must be updated as soon as the fix becomes available in the respective LTS version of Ubuntu: 24.04 (noble) and 26.04 (resolute). Watch the Ubuntu security tracker for the USN for CVE-2026-98432; once released, schedule the kernel update and reboot on all affected hosts. Until then, treat hosts as exposed.

Emergency security releases — pre-announcement (2026-10-23)¶

In parallel, TeskaLabs is preparing emergency security releases of LogMan.io to address recent security incidents in third-party components. The releases fix two things.

1. Removal of compromised eMudhra/emSign intermediate CA certificates¶

Affected containers are being rebuilt without potentially compromised certificates, tracked as CVE-2026-113470 and related. The certificates below are being removed:

emSign Root CA - G1
emSign Root CA - C1
emSign ECC Root CA - G3
emSign ECC Root CA - C3
ECC Root CA - G3

2. Node.js upgrade to address Node2Shell¶

The affected components (asab-pyppeteer and Kibana) are being upgraded to a fixed Node.js version to address Node2Shell (CVE-2026-111497).

Impacted versions¶

v26.12
v26.37
We are also assessing v25.47 and will confirm in the release notes.

Not affected¶

LogMan.io is not affected by the recent PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619). No action is needed for those.

Timeline¶

We will start rebuilding the affected containers early next week and release the new versions as soon as they are ready.
Plan for an upgrade in the coming days.
Watch for the release announcement and upgrade guidance.

What to do now¶

Patch the host kernel. Apply the USN for CVE-2026-98432 on Ubuntu 24.04 and 26.04 as soon as it is released, and reboot affected hosts. Until then, treat every production host as exposed.
Plan the emergency LogMan.io upgrade. The upcoming release fixes the certificate and Node.js issues in v26.12 and v26.37. Upgrade as soon as the release notes are published.
Ignore the PHP CVEs. LogMan.io is not affected by CVE-2026-109618 and CVE-2026-109619; no action is needed.

We will keep this post updated as the emergency releases ship and as the kernel USN becomes available.