Sophos Firewall: Fix CVE-2026-98432 with a Kernel Hotfix

Sophos has released a kernel hotfix for CVE-2026-98432. The crucial operational detail: a downloaded update only protects the firewall after the required restart. Anyone relying on automatic hotfix distribution should therefore check the installation status and schedule a maintenance window.

This article separates the technical vulnerability from the specific update procedure for Sophos devices. Sources checked: 11 November 2026. The linked vendor pages may add further firmware versions later.

Which Sophos versions need attention?

The following fixes are available for these products and SFOS versions:

This table lists available fixes, not every vulnerable build. Sophos does not publish a complete affected-version matrix there identifying the earliest and latest vulnerable SFOS versions. An absent table entry therefore does not establish that a version is safe. This applies, for example, when assessing an installation running SFOS 21.5 or 22.0 MR2.

Before changing versions, check the supported upgrade path and hardware compatibility. The article on SFOS 22.0 MR3 puts the maintenance release into context; the Sophos Firewall v23 overview describes the new major version. For a production system, deliberately select an appropriate generally released version. The availability of a hotfix for EAP1 is no reason to switch to a prerelease version for this correction.

How can the kernel vulnerability be exploited?

CVE-2026-98432 concerns a use-after-free flaw in the Linux kernel’s IPv4 TCP processing. A processing path accesses memory that has already been freed. The underlying race condition arises through the following concurrent operations:

1. During TCP connection establishment, IPv4 option data is passed between internal socket structures.
2. In parallel, another processor core can process a retransmitted SYN and prepare a SYN-ACK response.
3. If the associated structure is freed in the meantime, the concurrent processing path may still access its option data.

A race condition is a flaw whose occurrence depends on the timing of concurrent operations. A successful attack requires network processing and memory state to coincide appropriately. An ordinary connection attempt alone therefore does not demonstrate successful exploitation.

According to Sophos, unauthenticated remote code execution with kernel privileges is possible under certain conditions. The publicly described laboratory demonstration targeted a server with a Multipath TCP (MPTCP) listener. This is not published evidence of a successful takeover of a Sophos Firewall. Nor does it establish that disabling MPTCP alone removes the underlying vulnerability.

Sophos rates its advisory as High and cites different CVSS assessments: 9.8 from the Linux kernel CNA, and 5.9 from Red Hat because of the race condition. At the time of the advisory’s latest update on 6 November, Sophos was not aware of public reports of active exploitation. This dated statement does not guarantee that attacks will not occur.

In practice, assess reachability and patch status separately. Restricting management access is sensible, but does not prove that the affected kernel processing is unreachable. A successful login using MFA likewise says nothing about protection against an unauthenticated attack.

Guide: installing the hotfix on the firewall

1. Prepare for maintenance

Before making changes, create a current configuration backup and establish the recovery options. For remote sites, plan an alternative management connection or have someone available on site. This matters particularly when the only connection to the firewall runs through the VPN tunnel that will be interrupted during the restart.

Prepare a short list of business-critical connections for the subsequent checks: internet access, DNS, site-to-site VPN, remote access and published applications. A successful ping after maintenance does not replace functional testing of these services.

If the firewall runs an SFOS version other than those listed above, first plan the firmware upgrade. The SFOS firmware update guide explains the procedure. Plan the upgrade and hotfix installation as separate tasks.

2. Check the download and installation

1. Sign in to WebAdmin and look in the Control center for the notification about the downloaded kernel hotfix requiring a restart.

2. If automatic hotfixes are disabled, open 4 – Device Console in the CLI and enable them:

   system hotfix enable
   

3. Wait for the download. After a necessary firmware upgrade, the hotfix only becomes available afterwards; another restart is required to apply it.

4. Restart the firewall during the maintenance window. This interrupts traffic.

5. Afterwards, check in the Device Console:

   system hotfix list
   

The decisive result is the HF110626.1 entry with the status Installed. Merely seeing the hotfix in the list is insufficient. In SFOS 23.0, the Hotfix: Security updates page may still be empty despite installation; Sophos refers to the CLI check for this case.

3. Document the result

For an operational record, note the device name, SFOS version, maintenance time and verified hotfix status. Then carry out the prepared connection tests. This distinguishes successful installation from restored business operation.

If the hotfix is missing or its status remains unclear, do not record the maintenance as complete. First compare the firmware version, hotfix setting and download notification. If the problem persists, involve vendor support with these details. Repeated restarts without new findings are not reliable troubleshooting.

HA cluster: update both devices

Sophos specifies a fixed sequence: check the download notification on both devices, restart the auxiliary device first, wait for it to return, then restart the primary device. Both devices need the hotfix. According to the instructions, the CLI command for the hotfix list is currently only available on the current primary.

The auxiliary device must also be included when management is handled through Sophos Fusion. After failover, the notification may reappear because it concerns the other device, which is now active.

Before the second restart, also check that the partner is operational again and that the cluster is healthy. An HA pair is no reason to promise interruption-free maintenance: failover and session behaviour must be included in planning. To complete the work, record both devices individually in the maintenance log and test applications through the cluster.

Update SD-RED 20 and SD-RED 60 separately

The firewall hotfix does not replace the RED update. For SD-RED 20 and SD-RED 60, Sophos specifies firmware 3.0.012, released on 5 November:

1. In WebAdmin, open Backup & Firmware > Pattern Updates.
2. If the SD-RED firmware is older than 3.0.012, run Update Pattern Now.
3. Use Install to deploy the firmware to the connected SD-RED devices. They restart during installation.

For distribution, Sophos lists SFOS 20.0 MR3 and later, or SFOS 21.0 MR1 and later, as prerequisites. These details concern RED update distribution and must not be confused with the target versions for the firewall hotfix. Legacy RED models past end of support do not receive this correction.

After the restart, test an application over the RED connection at each branch site. With multiple devices, a site list showing firmware versions and test results helps: successfully updating one device does not establish the status of every other site.

Frequently asked maintenance questions

Is a restart without a visible hotfix notification sufficient?

A restart alone is not reliable evidence of installation. Completion depends on checking the status of HF110626.1. Without this evidence, installation remains unconfirmed.

Can Linux workarounds be applied to Sophos Firewall?

For Sophos devices, use the vendor’s procedure. Sophos explicitly separates its general Linux guidance from product-specific remediation. Custom kernel parameters or packet-filter changes from a Linux guide should therefore not be transferred to the appliance.

Sources

• Sophos: Hotfix for CVE-2026-98432 – installation and verification
• Ubuntu: Technical description of CVE-2026-98432
• Sophos: Security advisory for CVE-2026-98432
• Sophos: SD-RED firmware 3.0.012 for CVE-2026-98432