No impact incident

CloudLinux: BTR (CVE-2026-64507, CVE-2026-64508) Spectre v2 kernel memory leak

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Oct 5, 2026, 16:10 UTC
   identified
   BTR (CVE-2026-64507, CVE-2026-64508, Moderate per Red Hat) is a Spectre v2 variant that lets a local unprivileged user read kernel memory . It does not give root by itself. A public proof-of-concept exists for two Intel processor microarchitectures, and no exploitation in the wild has been reported. Affected: every CloudLinux version except CloudLinux 7. → Affected CloudLinux versions Processors: whether an attack can succeed also depends on the processor. The published exploit works on two Intel microarchitectures only. → Which processors are at risk Mitigation: none. → Is there a mitigation? Fix status: fixed upstream on July 25, 2026. Red Hat, AlmaLinux and Canonical haven’t released it yet. → Update instructions CloudLinux 7h and 8 kernel: CloudLinux builds it once AlmaLinux 8 has the fix. AlmaLinux kernel (CloudLinux 9, 10): follows Red Hat, which lists its kernels as affected and has released no fix yet. LTS kernels (CloudLinux 8 LTS, 9 LTS): follow Red Hat’s release. KernelCare livepatch: follows the vendor fixes. CloudLinux for Ubuntu 22.04: the fix comes from Canonical, which hasn’t released it for 22.04 yet. Why it matters: on a shared host, a compromised site is enough to run the attack. → Why this matters on a shared host How the bug works: the processor keeps old branch predictions when the kernel reuses memory for a new filter program. → Technical details of the bug
2. Oct 7, 2026, 12:34 UTC
   identified
   The published attack doesn’t work on the CloudLinux 7h and 8 kernels, according to our analysis of their code, so no update is needed for these versions. Red Hat lists RHEL 8 as affected by CVE-2026-64507 and not affected by CVE-2026-64508. If Red Hat releases a fix for RHEL 8, CloudLinux 7h and 8 will pick it up once AlmaLinux 8 has it, and we’ll note it here.
3. Oct 9, 2026, 03:49 UTC
   identified
   Red Hat now lists the RHEL 8 kernel as not affected by either CVE-2026-64507 or CVE-2026-64508. This matches our analysis of the CloudLinux 7h and 8 kernels: no update is needed for these versions, and no fix is expected for them.
4. Oct 14, 2026, 16:02 UTC
   identified
   CloudLinux 10 has a fixed kernel. AlmaLinux 10 kernel 6.12.0-211.65.1.el10_2 (ALSA-2026:81406) fixes both CVEs and is in the production repositories. To install it, run dnf update 'kernel*' and reboot. CloudLinux 9 has no fixed kernel yet. Red Hat released its RHEL 9 fix on October 13, and we’ll add the AlmaLinux 9 kernel version here when it’s out.

Updates as published by CloudLinux (original).