rewindex

ChangesLinode (Akamai)Customer Security Advisory: CVE-2026-98432

Linode (Akamai): Incident updated: Customer Security Advisory: CVE-2026-98432

Incident updateDownplayed?Normal progress (typesafe/jev-1.13-20260917, 100%)Changed status.linode.com (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Downplayed?

Vendor rated this none; a Hacker News thread about it drew 197 points and 109 comments. Linode Security Incident (opens in new tab)

This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. How this is computed.

Incident page: the full timeline of updates

What changed

Struck in red is what Linode (Akamai) removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1
Before: investigating
After: resolved
AddedResolved time#2
Before: not present
After: 2026-11-09 21:23 UTC
AddedAffected components#3
Before: not present
After: Customer Security Advisory, Customer Service, Documentation and Community - Customer Security Advisory
AddedUpdateresolved#4
Before: not present
After: We continue to monitor our systems and track upstream OS providers’ security releases; as of November 9, 2026, the majority of upstream vendors have provided updated kernel packages that include fixes for this vulnerability, and we recommend customers apply those updates to their Linodes. Customers using the Linode provided kernel are likewise advised to deploy the latest version as indicated on our kernels page. By applying IPv4 network rules to both public and VPC interfaces, we have already eliminated the immediate remote attack vector, addressing the root vulnerability rather than just the MPTCP exploit. We remain committed to improving our systems and reducing the risk of similar issues in the future.

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

Monday, November 9

1 incident change

Monday, November 2

1 rewrite, 1 incident change

Saturday, October 31

1 incident change

Friday, October 30

1 incident change

Cite this

Incident updated: Customer Security Advisory: CVE-2026-98432 on Linode (Akamai)’s status page, changed 2026-11-09 21:33 UTC (change 5 of 5).

Title
Incident updated: Customer Security Advisory: CVE-2026-98432
Vendor
Linode (Akamai)
Date
URL
https://rewindex.com/change/rad533207e1f680

All Linode (Akamai) changesLinode (Akamai) profileMarkdownJSON