Patched CloudLinux 8 LTS and CloudLinux 9 LTS kernels with the crypto (CVE-2025-39964) and TLS (CVE-2025-39682) fixes are now in the stable channel: - CloudLinux 8 LTS: kernel-lts-5.14.0-284.1101.el8.tuxcare.11.els17 or newer - CloudLinux 9 LTS: kernel-lts-5.14.0-284.1101.el9.tuxcare.11.els17 or newer
They also carry the bridge fix (CVE-2026-53266), so a regular update and a reboot close all three flaws: yum update reboot
CloudLinux 8 LTS has no livepatch on this kernel line, so this kernel update is its fix. Full per-version table in the blog article.
Posted Nov 04, 2026 - 00:26 UTC
Update
The CloudLinux 9 kernel with the crypto fix (CVE-2025-39964) is now in the stable channel. kernel-5.14.0-687.51.1.el9_8 or newer carries all three fixes, so one update and a reboot close them: dnf update kernel reboot
Posted Nov 03, 2026 - 12:42 UTC
Update
The crypto fix (CVE-2025-39964) is now in the stable channel for CloudLinux 7h and 8: kernel-4.18.0-553.168.1.lve or newer, released on 20 October. It also carries the bridge fix (CVE-2026-53266), so one update and a reboot close both flaws on these versions: yum update kernel reboot
Patched CloudLinux 8 LTS and 9 LTS kernels with the crypto and TLS fixes are in the beta channel: - CloudLinux 8 LTS: kernel-lts-5.14.0-284.1101.el8.tuxcare.11.els18 - CloudLinux 9 LTS: kernel-lts-5.14.0-284.1101.el9.tuxcare.11.els18 They move to the stable channel on the normal schedule.
CloudLinux 9: the kernel with the crypto fix is still in preparation. CloudLinux 10: 6.12.0-211.59.1.el10_2 or newer carries all three fixes.
Fixed kernels and livepatch coverage by CloudLinux version: - CloudLinux 7h and 8: the bridge fix (CVE-2026-53266) is in 4.18.0-553.142.1.lve and newer. The kernel with the crypto fix (CVE-2025-39964) is in staged rollout, and its version will be added when it reaches stable. - CloudLinux 9: the current kernel carries the TLS and bridge fixes (bridge fix from 5.14.0-687.23.1.el9_8). The kernel with the crypto fix is in preparation. - CloudLinux 10: 6.12.0-211.59.1.el10_2 or newer carries all three fixes. - CloudLinux 8 LTS and 9 LTS: the bridge fix is in kernel-lts-5.14.0-284.1101.tuxcare.11.els13 and newer. The crypto and TLS fixes are in preparation.
KernelCare livepatches are live for CloudLinux 7h, 8, 9 LTS and 10, and for the TLS and bridge flaws on CloudLinux 9. The crypto livepatch for CloudLinux 9 is in preparation. CloudLinux 8 LTS has no livepatch on this kernel line, so it needs the kernel update and a reboot.
Check all three CVEs on a KernelCare server: kcarectl --patch-info | grep -E 'CVE-2025-39964|CVE-2026-53266|CVE-2025-39682'
The KernelCare livepatch for the crypto flaw (CVE-2025-39964) on CloudLinux 7 has been on the main feed since October 9. Subscribed servers take it on their next update cycle, or you can apply it now with no reboot: kcarectl --update
The CloudLinux 7 livepatch for the bridge flaw is still in final release.
Posted Oct 13, 2026 - 16:03 UTC
Update
The KernelCare livepatch for the crypto flaw (CVE-2025-39964) on CloudLinux 7 has reached the testing feed. Servers on the default feed do not have it yet. To take it from the testing feed: kcarectl --update --prefix test
Once the patch reaches the main feed, subscribed servers take it on their next update cycle. This advisory will be updated then. The CloudLinux 7 livepatch for the bridge flaw is still in final release.
Posted Oct 09, 2026 - 19:43 UTC
Identified
On September 18, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue: CVE-2025-39964 (a crypto-socket flaw), CVE-2026-53266 (a bridge-firewall flaw), and CVE-2025-39682 (a kernel-TLS flaw). They are three separate bugs in different parts of the kernel. Fixing one has nothing to do with the others.
Which versions each one affects is in the affected table. In short: the crypto flaw affects every CloudLinux version; the bridge flaw affects every version but is reachable by an ordinary account only on some; the TLS flaw affects only CloudLinux 8 LTS, 9, 9 LTS, and 10.
The three flaws: CVE-2025-39964, the crypto-socket flaw: a public exploit escalates an ordinary account to root. → details CVE-2026-53266, the bridge-firewall flaw: memory corruption or privilege escalation, reachable by an ordinary account only where private network spaces are open. → details CVE-2025-39682, the kernel-TLS flaw: can leak kernel memory or crash the machine on affected systems. → details
Two fix routes: a KernelCare livepatch applies with no reboot where one is available; otherwise the fix is a kernel update and reboot. The fix-status table gives both routes per version, and the update instructions carry the streams.