KernelCare livepatch for CloudLinux 7 hybrid and 8 is on the main feed The livepatch for ZDI-CAN-33367 reached the main feed on 29 October (K20261028_0017, K20261028_0018). Subscribed servers take it on their next update cycle, or you can apply it now with no reboot: kcarectl --update
To check a server: kcarectl --patch-info | grep ZDI-CAN-33367
Fixed kernels are now in production for CloudLinux 7 hybrid, 8, 9 and 10. The livepatch is available for CloudLinux 7 hybrid, 8, 9, and 10.
Posted Nov 03, 2026 - 05:03 UTC
Update
Fixed kernels for CloudLinux 7 hybrid and 8 are now released to production:
- CloudLinux 7 hybrid: kernel-4.18.0-553.177.1.lve.1.el7h or newer - CloudLinux 8: kernel-4.18.0-553.177.1.lve.1.el8 or newer
A regular update installs them, so the cloudlinux-rollout-2-bypass repository is no longer needed: yum clean all && yum update 'kernel*' reboot
Fixed kernels for CloudLinux 9 and 10 are released to production through the AlmaLinux kernel updates: - CloudLinux 9: kernel-5.14.0-687.60.1.el9_8 or newer - CloudLinux 10: kernel-6.12.0-211.69.1.el10_2 or newer
A full update and a reboot install them: dnf update reboot
The EL9 KernelCare livepatch is now in the ePortal feed as well, since 28 October. Apply it without a reboot with kcarectl --update.
Livepatch released for EL9, production feed since 2026-10-26. Not in the ePortal feed yet. - AlmaLinux 9 and CloudLinux 9: K20261023_0016 - RHEL 9: K20261023_0015. Oracle Linux 9: K20261023_0018. Rocky Linux 9: K20261023_0019
EL10 livepatch now also in the ePortal feed. RHEL 10, Oracle Linux 10, Rocky Linux 10 since 2026-10-26. AlmaLinux 10 and CloudLinux 10 since 2026-10-27.
EL8 livepatch is ready for release. Not released yet.
Debian and Ubuntu: livepatch work in progress. No date yet.
Fixed kernels: AlmaLinux 9 kernel 5.14.0-687.60.1.el9_8 includes the fix (also covers CloudLinux 9). AlmaLinux 10 kernel not fixed yet. CloudLinux 7h and 8 fixed kernels 4.18.0-553.177.1.lve.1 are in beta.
Upstream fix accepted into the networking tree: Not in the mainline kernel yet. No CVE yet.
No report of exploitation in the wild
Posted Oct 27, 2026 - 08:35 UTC
Update
AlmaLinux published fixed kernels for AlmaLinux 8, 9, and 10 to its testing repository on 23 October: kernel-4.18.0-553.177.2.el8_10, kernel-5.14.0-687.59.2.el9_8, and kernel-6.12.0-211.68.2.el10_2. CloudLinux 9 and 10 use the same kernels as AlmaLinux, and the CloudLinux builds follow. AlmaLinux backported the netdev fix without waiting for an upstream CentOS Stream or RHEL update. No CVE has been assigned yet.
Posted Oct 26, 2026 - 20:58 UTC
Update
Kernels with the fix have been released to the beta and rollout channels: - CloudLinux 7 hybrid: kernel-4.18.0-553.177.1.lve.1.el7h - CloudLinux 8: kernel-4.18.0-553.177.1.lve.1.el8
To install it now, first make sure the server runs the latest cloudlinux-release package: CloudLinux 7 hybrid: yum update cloudlinux-release CloudLinux 8: dnf upgrade cloudlinux-release
Target versions: - CloudLinux 7 hybrid: cloudlinux-release-7.9-2.18.el7h or newer - CloudLinux 8: cloudlinux-release-8.10-16.el8 or newer
Then install the kernel and reboot into it: CloudLinux 7 hybrid: yum clean all && yum update 'kernel*' --enablerepo=cloudlinux-rollout-2-bypass CloudLinux 8: dnf clean all && dnf update 'kernel*' --enablerepo=cloudlinux-rollout-2-bypass reboot
To confirm the fix is in the installed kernel, check its changelog for CLKRN-2389: rpm -q --changelog kernel-core-$(uname -r) | grep CLKRN-2389
CloudLinux 9 and 10: the fix is coming from AlmaLinux, and we will release it as soon as it is available.
Posted Oct 23, 2026 - 22:12 UTC
Identified
ZDI-CAN-33367 (no CVE assigned) is a flaw in the Linux kernel networking stack that lets any local user rewrite files they can only read, which leads to root. A public exploit exists. A KernelCare livepatch is released for CloudLinux 10, and no fixed kernel has shipped for any line.
Affected: a server is exposed when ordinary users can create their own namespaces. CloudLinux 7 hybrid is exposed as shipped. CloudLinux 8, 8 ELS, 9, and 9 ELS are closed by default on servers installed since mid-2024 and exposed on older ones. CloudLinux 10 and CloudLinux for Ubuntu 22.04 are closed by default. CloudLinux 7 is not affected. (affected versions)
Already applied the Dirty Frag fix (CVE-2026-43284)? It does not protect you from this one.
Mitigation: set user.max_user_namespaces to 0. It applies without a reboot and stops rootless containers for ordinary accounts. (mitigation)