VyOS 1.5.1-S1 and 1.4.5-S1 released: security fixes in the Linux kernel and FRR

Key points

VyOS published two security releases on 9 November 2026: 1.5.1-S1 and 1.4.5-S1, which replace 1.5.1 and 1.4.5. Both carry two hand-backported Linux kernel fixes, and 1.5.1-S1 also updates FRR to fix three flaws in bgpd. The project asks anyone on 1.5.1, 1.4.5 or older to upgrade promptly.

Versions

• An -S1 release is a security update to an existing LTS release: same version and feature set, with only security fixes added.
• The kernel remains 6.6.144 in both releases; the binary version was kept unchanged for compatibility.
• The rebuilt kernel package is identified by its revision: 6.6.144-1+vyos-1-5-1-S1 or 6.6.144-1+vyos-1-4-5-S1.
• 1.5.1-S1 moves FRR to 10.5.5.
• 1.4.5-S1 contains the two kernel fixes and nothing else.

Kernel fixes (both releases)

• CVE-2026-98432 is an IPv4/TCP use-after-free: IP options handed from a request socket to a new child socket could be freed while another CPU still used them. A remote attacker could crash the system, corrupt memory or possibly execute code.
• CVE-2026-99999 ("PwnEscape") is an out-of-bounds write in IPv4 checksum handling: a malformed checksum start offset lets a packet overwrite the already validated IPv4 header. A local attacker or an untrusted VM on the same host could cause memory corruption, code execution, denial of service or information disclosure.

FRR fixes (1.5.1-S1 only)

• All three bgpd flaws can be triggered by a BGP peer sending malformed UPDATE messages.
• CVE-2026-37457: an out-of-bounds write through a crafted FlowSpec NLRI, which can corrupt memory and crash bgpd.
• CVE-2026-37459: an out-of-bounds read through a crafted Next Hop Capability attribute, leading to denial of service.
• CVE-2026-37460: out-of-bounds reads from truncated EVPN Type-2, Type-3 and Type-4 NLRI and from truncated or zero-length ENCAP/VNC sub-TLVs.
• A backported ospfd fix is included as well: a crafted Opaque LSA could crash ospfd when debug ospf packet ... detail was enabled.

How to upgrade

• Images are available to subscribers in the Support Portal; download the one for your version and install it as an in-place image upgrade, as with any LTS release.
• Update images for cloud deployments are in the Downloads section of the Support Portal.
• Cloud marketplace listings will get the new versions once the cloud providers update them.
• If you applied the patch from the latest security advisory (or a similar one) that runs a custom script after every commit, remove it before upgrading:

rm /config/scripts/commit/post-hooks.d/cve-2026-98432

Summary by DistroNews, based on the original post.