A corrected kernel has been available since 9 November 2026. If you operate onway systems yourself, we recommend installing the update. The firewall rule from the information sheet now serves only as an interim measure if you cannot update right away. In the onway Cloud, onway is rolling out the update to all instances step by step.

A vulnerability has been disclosed in the Linux kernel (CVE-2026-98432). It affects every Linux system with a reachable TCP service, including onway products. No attacks have been reported so far. onway has already taken action.

What this means for you depends on how you operate our products:

• Instances in the onway Cloud
  onway has already applied the interim mitigation and is now rolling out the kernel update to all instances step by step. No action is required on your part.
• Your own installations
  A corrected kernel has been available since 9 November 2026. If you operate onway director, mpp, onway registrar, macman, Mixer, EST CA, the customer entry point or a VPN gateway yourself, please install the kernel update and then restart the system. The update only takes effect after the restart. If you cannot install the update right away, apply the firewall rule described in our information sheet in the meantime, starting with the systems that are reachable from the internet.
• Routers running CarlOS
  By default, CarlOS has no open TCP ports. If GNSS or the local router API is enabled, TCP ports are open. These are usually reachable only from internal networks. A CarlOS release with a fix will follow and will be listed in the release notes: https://support.onway.ch/onway-router/pubdoc/latest/NEWS.html

The information sheet describing the interim mitigation is available for download in English, German and French. We will keep this page and the information sheet up to date.

The date of the latest update is shown on the information sheet. If you have any questions, please contact us via our support portal.

Change log:

10 November 2026: Kernel update available, recommendations updated

10 November 2026: First published