The following patchsets are available for ePortal - - rhel10 (K20260812_0007) - oel10 (K20260812_0008) - rockylinux10 (K20260812_0009) - almalinux10 (K20260812_0010)
Subscribed servers on those versions receive the patch automatically on the next update cycle, or immediately with kcarectl --update.
To check if you're patched, check build time with kcarectl --info | grep kpatch-build-time.
rhel10 -> build dated 2026-08-14 or later
oel10, rockylinux10, almalinux10 -> build dated 2026-08-17 or later
In the testing feed: ubuntu-jammy kernel (K20260817_0001) - this is for the generic 22.04 stream
Pending (almost ready for release): EL8 family
Posted Aug 18, 2026 - 21:32 UTC
Update
KernelCare livepatches for Zapscape are now in the main feed for:
CloudLinux 9 CloudLinux 10
Subscribed servers on those versions receive the patch automatically on the next update cycle, or immediately with kcarectl --update.
For CloudLinux 10: The CVE tag is still being added to the CloudLinux 10 patch metadata, so kcarectl --patch-info | grep 'CVE-2026-64561' can return empty on a server that is already patched. Until the metadata lands, verify with kcarectl --info | grep kpatch-build-time instead (build dated August 12, 2026 or later).
CloudLinux kernel (CloudLinux 7h, CloudLinux 8). Patched kernels: - CloudLinux 7h: kernel-4.18.0-553.150.1.lve.el7h or newer - CloudLinux 8: kernel-4.18.0-553.150.1.lve.el8 or newer
The stable channel still carries 553.144.1, so a plain yum update kernel does not pick up this fix yet. The gradual rollout has reached slot 9. To take it right now on CloudLinux 8, either use the rollout bypass repository: yum update 'kernel*' --enablerepo=cloudlinux-rollout-9-bypass reboot
or the beta channel: yum update 'kernel*' --enablerepo=cloudlinux-updates-testing reboot
On CloudLinux 7h: yum update 'kernel*' --enablerepo=cl7h_beta reboot
Once the kernels reach the stable channel, a plain yum update kernel; reboot is enough.
AlmaLinux kernel (CloudLinux 9, CloudLinux 10). Both are already fixed in the AlmaLinux production repositories, no testing repository needed: - CloudLinux 9: kernel-5.14.0-687.30.1.el9_8 or newer (ALSA-2026:45192) - CloudLinux 10: kernel-6.12.0-211.39.1.el10_2 or newer (ALSA-2026:45114)
The fix shipped in the July 24 upstream kernel batch, which predates the public disclosure of Zapscape, so a server that took a kernel update in the past two weeks may already be covered. Check with uname -r before planning a reboot window.
dnf update 'kernel*' reboot
TuxCare ELS kernel (CloudLinux 8 LTS, CloudLinux 9 LTS). The patched kernel-lts package is in preparation. Once it ships, ELS-subscribed customers install it from the TuxCare ELS repository with yum update kernel-lts and reboot.
KernelCare livepatch. Not available for any CloudLinux platform yet. Livepatches are still in preparation for CloudLinux 7h, 8, 9 and 10. From the testing feed once available: kcarectl --update --prefix test
Once promoted to the main feed, subscribed servers pick it up on the next update cycle, or on demand with kcarectl --update.
How to verify. For a kernel update, compare uname -r against the target version for your platform above. For the livepatch: kcarectl --patch-info | grep 'CVE-2026-64561'
Use --patch-info for this. kcarectl --info | grep CVE-... comes back empty even on a correctly patched server.
Full advisory and per-platform instructions in the blog post.
Posted Aug 11, 2026 - 13:34 UTC
Identified
Zapscape (CVE-2026-64561) is a vulnerability in the Linux kernel’s KVM code.