KernelCare live patches shipped for el8 + el9 kernels: (RHEL/CentOS/Oracle/CloudLinux/Alma/Rocky, including cl8, cl7h and el9 FIPS/LTS)
el10, UEK R6/R7, and Amazon Linux 2/2023 still in progress.
Deploying the livepatch: kcarectl --update --prefix test # from testing feed kcarectl --update # once promoted to main
How to verify you are patched: uname -r # fixed if: 5.14.0-687.26.1.el9_8+ / 4.18.0-553.144.1.el8_10+ / 6.12.0-211.34.1.el10_2+ kcarectl --info | grep kpatch-build-time # el8/el9 livepatch build dated 2026-07-16/17 or later kcarectl --patch-info | grep -iE 'xfs|CVE-2026-64600' # silent releases carried no CVE ref at ship time
Posted Jul 23, 2026 - 06:09 UTC
Monitoring
The patched CL8 kernel is available in our rollout repositories. Target version:
- CL8: kernel-4.18.0-553.144.1.lve.el8 or newer
To update, please run: dnf update 'kernel*' --enablerepo=cloudlinux-rollout*
The patched CL9/CL10 are available in the stable repository. Target versions:
- CL9: kernel-5.14.0-687.26.1.el9_8 or newer - CL10: kernel-6.12.0-211.34.1.el10_2 or newer
Posted Jul 23, 2026 - 00:10 UTC
Investigating
RefluXFS (CVE-2026-64600), an XFS reflink direct-I/O race. A lock-drop window in the copy-on-write allocation path lets an unprivileged local user overwrite the on-disk contents of any file they can read (e.g.,/etc/passwd or a SUID-root binary) on any XFS with reflink=1 (the mkfs default since 2019, so the CloudLinux default). Result is full root.
CloudLinux 8, 9, and 10 are affected. The mitigation, patched kernel packages, and KernelCare live patch are currently in preparation. There is no fixed kernel to update to and no live patch in the feeds at this time.