Kernels with the fix have been released to the beta and rollout channels: - CloudLinux 7 hybrid: kernel-4.18.0-553.177.1.lve.1.el7h - CloudLinux 8: kernel-4.18.0-553.177.1.lve.1.el8
To install it now, first make sure the server runs the latest cloudlinux-release package: CloudLinux 7 hybrid: yum update cloudlinux-release CloudLinux 8: dnf upgrade cloudlinux-release
Target versions: - CloudLinux 7 hybrid: cloudlinux-release-7.9-2.18.el7h or newer - CloudLinux 8: cloudlinux-release-8.10-16.el8 or newer
Then install the kernel and reboot into it: CloudLinux 7 hybrid: yum clean all && yum update 'kernel*' --enablerepo=cloudlinux-rollout-2-bypass CloudLinux 8: dnf clean all && dnf update 'kernel*' --enablerepo=cloudlinux-rollout-2-bypass reboot
To confirm the fix is in the installed kernel, check its changelog for CLKRN-2389: rpm -q --changelog kernel-core-$(uname -r) | grep CLKRN-2389
CloudLinux 9 and 10: the fix is coming from AlmaLinux, and we will release it as soon as it is available.
Posted Oct 23, 2026 - 22:12 UTC
Identified
ZDI-CAN-33367 (no CVE assigned) is a flaw in the Linux kernel networking stack that lets any local user rewrite files they can only read, which leads to root. A public exploit exists. A KernelCare livepatch is released for CloudLinux 10, and no fixed kernel has shipped for any line.
Affected: a server is exposed when ordinary users can create their own namespaces. CloudLinux 7 hybrid is exposed as shipped. CloudLinux 8, 8 ELS, 9, and 9 ELS are closed by default on servers installed since mid-2024 and exposed on older ones. CloudLinux 10 and CloudLinux for Ubuntu 22.04 are closed by default. CloudLinux 7 is not affected. (affected versions)
Already applied the Dirty Frag fix (CVE-2026-43284)? It does not protect you from this one.
Mitigation: set user.max_user_namespaces to 0. It applies without a reboot and stops rootless containers for ordinary accounts. (mitigation)