Fixed kernels are now available: - CloudLinux 7h and 8: 4.18.0-553.184.1.lve.1, in staged rollout. To install now: yum update cloudlinux-release, then yum update kernel --enablerepo=cloudlinux-rollout-10-bypass and reboot. - CloudLinux 9: kernel-5.14.0-687.66.2.el9_8, CloudLinux 10: kernel-6.12.0-211.74.2.el10_2, in the AlmaLinux testing repository (Red Hat has not released a fix yet). - CloudLinux 8 LTS and 9 LTS: kernel-ltsels17 or newer, in the stable channel since November 2. - CloudLinux 7: fixed kernel in preparation.
This update replaces older statements where they differ.
- The privilege escalation exploit on AlmaLinux 8 is not stable, but it worked several times. The "about 70 seconds" in the previous update was one run. - AlmaLinux 9 and 10: reproduction is in progress. Not reproduced yet. - The KernelCare livepatch will most likely cover all EL family kernels (8, 9 and 10), including RHEL, AlmaLinux, Rocky, Oracle Linux and CloudLinux 9 and 10. No ETA yet. - CloudLinux 8 livepatch K20261105_0055 remains on the production feed since 2026-11-06 08:50 UTC. ePortal: still pending.
To check a server: kcarectl --patch-info | grep 'CVE-2026-98276'
Posted Nov 06, 2026 - 19:53 UTC
Update
This update replaces older statements in this doc where they differ.
Privilege escalation is reproduced in-house. We got root on AlmaLinux 8 with the stock kernel 4.18.0-553.el8_10 in about 70 seconds. The exploit is built on the code taken from the attacked server. Treat this CVE as a local privilege escalation, not only a crash.
On the attacked CloudLinux 8 server we see crashes only. Root on that server is not shown.
CloudLinux 8 livepatch K20261105_0055 is on the production feed since 2026-11-06 08:50 UTC. ePortal: pending. Not yet confirmed against the privilege escalation exploit.
A livepatch for RHEL and AlmaLinux 8 is expected. No ETA yet. EL 9 and 10: no decision yet.
Correction: "Present since Linux 2.6.12" is not confirmed. The CVE record uses 2.6.12 as a default start point. The real start point is not verified. The affected list from Red Hat (RHEL 7, 8, 9 and 10) does not change.
Posted Nov 06, 2026 - 16:55 UTC
Monitoring
State as of 2026-11-06, 09:35 UTC.
- Published as CVE-2026-98276 by the kernel CNA on 2026-10-06 (CVE record). CNA score 7.8 High, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Red Hat: Moderate 7.0 (AC:H). - The upstream fix landed in Linux 7.3-rc4 and in all stable lines before any exploitation was reported. This is not a zero-day. - A local user with a normal account can trigger it. It is not reachable from the network. - A working exploit was used against one CloudLinux 8 server on 2026-11-04. The server crashed 12 times. No privilege escalation was seen. No public exploit code found. - CloudLinux 8, 9 and 10 kernels are affected. Red Hat has no fixed kernel for RHEL 7, 8, 9 or 10 and lists no mitigation.
Impact confirmed: kernel crash (denial of service) by a local user. We reproduced the crash in-house. Privilege escalation is not reproduced and not shown.
The KernelCare livepatch for CloudLinux 8 is released (K20261105_0055, production feed since 2026-11-06 08:50 UTC). Run kcarectl --update. We made it ahead of the vendor.
Technical summary
The bug is in sock_gettstamp() in net/core/sock.c. This is the kernel handler for the SIOCGSTAMP and SIOCGSTAMPNS ioctls, which return the time a packet arrived. - On first use the handler sets a flag in the socket flags word without the socket lock. - The flag update is not atomic. A bind() on the same UDP socket at the same moment can lose its own update to the same word. - The lost flag is SOCK_RCU_FREE. It tells the kernel to wait for readers before it frees the socket. - Without it, the socket is freed at once on close, while the UDP receive path can still use it. This is a use-after-free. - The fix takes the socket lock in sock_gettstamp(), only when the flag must be set. - Present since Linux 2.6.12, so all supported kernels are affected.
Crash signature on the attacked CloudLinux 8 server: - WARNING ... at net/ipv4/af_inet.c:153 and :156 in inet_sock_destruct - then a NULL pointer dereference in udp_destruct_common (socket close) or in __sk_mem_raise_allocated called from __udp_enqueue_schedule_skb (UDP receive) - with kernel.panic_on_oops = 1 each crash rebooted the server
What the KernelCare livepatch does
- Ports the upstream fix: take the socket lock around the flag update. Small change, no data structure change. - LibCare is out of scope (kernel bug).
Mitigation
There is no practical mitigation. Install the livepatch where it is released. - No sysctl or kernel option turns the affected code off. Any user who can open a UDP socket can reach it. - A firewall does not help. The trigger is local socket calls and does not pass through iptables or nftables. - An SELinux policy can block the two ioctls, but control panels require SELinux to be disabled on CloudLinux. Not a usable option for most servers. - Restricting or suspending untrusted local accounts lowers the risk until the livepatch is installed.
Coverage status, 2026-11-06
Upstream stable: fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3. EL family (RHEL, AlmaLinux, CloudLinux, Rocky, Oracle Linux RHCK) 8, 9 and 10, and RHEL 7: affected. Red Hat: "Affected", no fix, no date. CloudLinux 9 and 10 run AlmaLinux kernels. Debian: fixed. trixie 6.12.113-1 (DSA-6568-1), bookworm 6.1.190-1 (DLA-4841-1) and linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1). Ubuntu: not verified.
Livepatch status: - CloudLinux 8 (K20261105_0055): production feed since 2026-11-06 08:50 UTC. Not on ePortal yet. - Debian 13 (K20261024_0026): production feed since 2026-10-26 08:36 UTC, ePortal since 2026-10-28 12:07 UTC. - Debian 12 (K20261102_0001): production feed since 2026-11-03 08:16 UTC, ePortal since 2026-11-05 08:36 UTC. - RHEL, AlmaLinux, Rocky and Oracle Linux 8, and the EL 9 and 10 family including CloudLinux 9 and 10: not released. No ETA yet.