VyOS Networks Blog

Hello, Community!

VyOS 1.5.1-S1 and VyOS 1.4.5-S1 are available, and subscribers can download images from the Support Portal.

Both are security releases. They replace VyOS 1.5.1 and VyOS 1.4.5 and contain only security fixes: two in the Linux kernel for both versions, and three more in FRR for 1.5.1-S1. If you run VyOS 1.5.1 or 1.4.5 or older, upgrade promptly.

What the -S1 suffix means

An -S1 release is a security update to an existing LTS release. It keeps the same version and the same features, with the security fixes applied, and it installs as an in-place image upgrade like any LTS release.

Linux kernel fixes (both versions)

The kernel stays at 6.6.144, the same version as in 1.5.1 and 1.4.5. We backported the two fixes below by hand and left the binary version unchanged for compatibility. The rebuilt package carries a release-specific revision, 6.6.144-1+vyos-1-5-1-S1 or 6.6.144-1+vyos-1-4-5-S1, which identifies the build.

• CVE-2026-98432, IPv4/TCP use-after-free. The kernel could free IP options passed from a request socket to a new child socket while another CPU was still using them. A remote attacker could exploit this to crash the system, corrupt memory, or possibly execute code.
• CVE-2026-99999, IPv4 checksum out-of-bounds write ("PwnEscape"). Packets with a malformed checksum start offset could overwrite the already validated IPv4 header. A local attacker, or an untrusted VM on the same host, could use this for memory corruption, code execution, denial of service, or information disclosure.

FRR fixes (1.5.1-S1 only)

VyOS 1.5.1-S1 updates FRR to 10.5.5. This fixes three vulnerabilities in bgpd, all of which a BGP peer can trigger by sending malformed UPDATE messages:

• CVE-2026-37457, FlowSpec out-of-bounds write. A crafted FlowSpec NLRI can corrupt memory and crash bgpd.
• CVE-2026-37459, Next Hop Capability out-of-bounds read. A crafted NHC attribute causes an out-of-bounds read and a denial of service.
• CVE-2026-37460, EVPN and ENCAP/VNC out-of-bounds read. Truncated EVPN Type-2, Type-3, and Type-4 NLRI, and truncated or zero-length ENCAP/VNC sub-TLVs, cause out-of-bounds reads.

The update also backports a fix for ospfd: a crafted Opaque LSA could crash ospfd while "debug ospf packet ... detail" was enabled.

VyOS 1.4.5-S1 contains the two kernel fixes only.

How to upgrade

Download the image for your version from the Support Portal and install it as an in-place image upgrade. Update images for cloud deployments are available in Downloads in the Support Portal as well. New versions will be published in cloud marketplaces as soon as cloud providers update listings.

If you added the patch that was mentioned in the latest security advisory, or similar, which includes running a custom script after every commit, then you should remove this patch before the upgrade:

rm /config/scripts/commit/post-hooks.d/cve-2026-98432