---
title: "SKS Node Templates Updated to Mitigate CVE-2026-98432"
date: 2026-11-13
tags: ["SKS","Security"]
url: https://changelog.exoscale.com/sks-node-templates-updated-cve-2026-98432/
---
# SKS Node Templates Updated to Mitigate CVE-2026-98432

All updated SKS node templates are now available to mitigate
[CVE-2026-98432](https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432),
a critical Linux kernel vulnerability affecting IPv4 TCP connection handling.

To check whether your worker nodes are running an updated template, run
`kubectl get nodes`.

Your nodes are not affected if every value in the `VERSION` column is one of the following:

* `v1.34.13`
* `v1.35.10`
* `v1.36.6`
* `v1.37.2`

Worker nodes managed through SKS NodePools that report any other version must
be cycled to apply the updated template. If a NodePool is pinned to a specific
template, select the corresponding updated template or switch the NodePool to
**Latest** before cycling it.

Karpenter-managed nodes are cycled automatically within minutes after an
updated template is published, provided Karpenter is allowed to replace them.
This automatic replacement is enabled by default. After the rollout, run
`kubectl get nodes` again to verify that every node is running one of the
versions listed above.

[Learn how to cycle SKS NodePools](https://community.exoscale.com/product/compute/containers/how-to/lifecycle-management/#nodepool-upgrade)