A new kernel CVE dropped in August 2026, but basically everyone ignored it. I saw it pop up on r/netsec for a day, grab a few upvotes, and vanish. But if you are hosting VMs on Proxmox or KVM, or running Docker containers, this is actually a massive headache waiting to happen.
The bug hits the Linux bridge spanning-tree protocol (STP) subsystem. To put it simply: if a garbage BPDU frame hits your Layer 2 segment, the kernel bridge panics. The state machine wedges, or you get memory corruption.
In a production environment, if that happens, every single VM drops offline instantly. In a homelab, your entire self-hosted setup just dies.
I spent this morning patching a Proxmox node and fighting with apt repos to get the update down. Here are my exact notes on how to check your bridges, bypass the enterprise repo errors, and actually get the kernel patched.
Audit Your Current Bridges
Before pulling updates, let's see what is currently running. Drop into a root shell on your hypervisor and check the active bridges.
bridge link
You should see your main physical adapter (like nic0 or eno1) attached to vmbr0 with a state of forwarding. If you see blocking when you shouldn't, your bridge state machine might already be corrupted.
You can also check the forwarding database to ensure the bridge is learning MAC addresses properly and is not corrupted.
bridge fdb show
Prepare Your Repositories
How you fetch the patch depends entirely on your Proxmox license tier.
If you have a paid Enterprise subscription:
You don't need to change a thing. Your repositories are already active and authorized. Skip the below instruction and move to the next step: Pull the Kernel Patch.
If you are running the free version:
Proxmox 9 switched from the old .list files to the new deb822 format. If you run an update on a fresh free install, apt throws "Network is unreachable" timeouts because it's trying to hit enterprise.proxmox.com without a key.
Old sed commands to comment out the enterprise repo don't work easily on the new .sources files. So we rename the enterprise files so apt ignores them entirely and then add the free repo back in.
# Move the enterprise sources out of the way mv /etc/apt/sources.list.d/pve-enterprise.sources /etc/apt/sources.list.d/pve-enterprise.sources.bak mv /etc/apt/sources.list.d/ceph.sources /etc/apt/sources.list.d/ceph.sources.bak # Inject the free no-subscription repository echo "deb http://download.proxmox.com/debian/pve trixie pve-no-subscription" > /etc/apt/sources.list.d/pve-no-subscription.list
Pull the Kernel Patch and Reboot
Because this bug lives in the kernel, we need to pull down a new kernel package. On Proxmox, a standard apt upgrade won't do it. You have to use dist-upgrade.
apt update && apt dist-upgrade -y
Watch the output on your terminal. You are looking for a package like proxmox-kernel-7.0.14-14-pve-signed (or whatever the latest version is for your distro) to install.
Once it finishes, schedule a few minutes of downtime and bounce the server. Your VMs rely on the host kernel for forwarding, so a reboot is mandatory.
reboot
Verify the Fix
Don't just assume the patch worked because the server pinged back. SSH back in and confirm the new kernel actually loaded.
uname -r
Next, make sure your bridges initialized correctly and your VMs are back online.
bridge link
Expected Output:
If your VMs are not set to auto-start, you won't see their virtual interfaces (like fwpr198p0 or tap100i0) attached to vmbr0. You can check their status and spin them back up manually from the command line.
# Find your stopped VMs qm list # start VM using VM ID qm start [VM_ID]
Run bridge link one last time. As long as those VM interfaces show state forwarding, your virtualization stack is fully patched and immune to the STP bug.
