No impact incident

CloudLinux: Three KEV-listed Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682)

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Oct 7, 2026, 12:48 UTC
   identified
   On September 18, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue: CVE-2025-39964 (a crypto-socket flaw), CVE-2026-53266 (a bridge-firewall flaw), and CVE-2025-39682 (a kernel-TLS flaw). They are three separate bugs in different parts of the kernel. Fixing one has nothing to do with the others. Which versions each one affects is in the affected table . In short: the crypto flaw affects every CloudLinux version; the bridge flaw affects every version but is reachable by an ordinary account only on some; the TLS flaw affects only CloudLinux 8 LTS, 9, 9 LTS, and 10. The three flaws: CVE-2025-39964, the crypto-socket flaw: a public exploit escalates an ordinary account to root. → details CVE-2026-53266, the bridge-firewall flaw: memory corruption or privilege escalation, reachable by an ordinary account only where private network spaces are open. → details CVE-2025-39682, the kernel-TLS flaw: can leak kernel memory or crash the machine on affected systems. → details Two fix routes: a KernelCare livepatch applies with no reboot where one is available; otherwise the fix is a kernel update and reboot. The fix-status table gives both routes per version, and the update instructions carry the streams. Check whether a server is patched → How to verify How the bugs work → Technical details
2. Oct 9, 2026, 19:43 UTC
   identified
   The KernelCare livepatch for the crypto flaw (CVE-2025-39964) on CloudLinux 7 has reached the testing feed. Servers on the default feed do not have it yet. To take it from the testing feed: kcarectl --update --prefix test Once the patch reaches the main feed, subscribed servers take it on their next update cycle. This advisory will be updated then. The CloudLinux 7 livepatch for the bridge flaw is still in final release.
3. Oct 13, 2026, 16:03 UTC
   identified
   The KernelCare livepatch for the crypto flaw (CVE-2025-39964) on CloudLinux 7 has been on the main feed since October 9. Subscribed servers take it on their next update cycle, or you can apply it now with no reboot: kcarectl --update The CloudLinux 7 livepatch for the bridge flaw is still in final release.
4. Oct 22, 2026, 05:25 UTC
   identified
   Fixed kernels and livepatch coverage by CloudLinux version: - CloudLinux 7h and 8: the bridge fix (CVE-2026-53266) is in 4.18.0-553.142.1.lve and newer. The kernel with the crypto fix (CVE-2025-39964) is in staged rollout, and its version will be added when it reaches stable. - CloudLinux 9: the current kernel carries the TLS and bridge fixes (bridge fix from 5.14.0-687.23.1.el9_8 ). The kernel with the crypto fix is in preparation. - CloudLinux 10: 6.12.0-211.59.1.el10_2 or newer carries all three fixes. - CloudLinux 8 LTS and 9 LTS: the bridge fix is in kernel-lts-5.14.0-284.1101.tuxcare.11.els13 and newer. The crypto and TLS fixes are in preparation. KernelCare livepatches are live for CloudLinux 7h, 8, 9 LTS and 10, and for the TLS and bridge flaws on CloudLinux 9. The crypto livepatch for CloudLinux 9 is in preparation. CloudLinux 8 LTS has no livepatch on this kernel line, so it needs the kernel update and a reboot. Check all three CVEs on a KernelCare server: kcarectl --patch-info | grep -E 'CVE-2025-39964|CVE-2026-53266|CVE-2025-39682' Full per-version table in the blog article .

Updates as published by CloudLinux (original).