No impact incident

CloudLinux: ZDI-CAN-33367: Linux Kernel Local Root Zero-Day, Mitigation for CloudLinux

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Oct 23, 2026, 19:26 UTC
   identified
   ZDI-CAN-33367 (no CVE assigned) is a flaw in the Linux kernel networking stack that lets any local user rewrite files they can only read, which leads to root. A public exploit exists. A KernelCare livepatch is released for CloudLinux 10, and no fixed kernel has shipped for any line. Affected: a server is exposed when ordinary users can create their own namespaces. CloudLinux 7 hybrid is exposed as shipped. CloudLinux 8, 8 ELS, 9, and 9 ELS are closed by default on servers installed since mid-2024 and exposed on older ones. CloudLinux 10 and CloudLinux for Ubuntu 22.04 are closed by default. CloudLinux 7 is not affected. ( affected versions ) Already applied the Dirty Frag fix (CVE-2026-43284)? It does not protect you from this one. Mitigation: set user.max_user_namespaces to 0. It applies without a reboot and stops rootless containers for ordinary accounts. ( mitigation ) Fix status: a livepatch is released for CloudLinux 10. No fixed kernel yet. ( update instructions ) Stream 1, CloudLinux kernel (CL7h, CL8) : waiting on the upstream fix, which is posted for review. Stream 2, AlmaLinux kernel (CL9, CL10) : no fixed kernel yet. Stream 3, TuxCare ELS kernel (CL8 ELS, CL9 ELS) : pending on the extended-support channel. Stream 4, KernelCare livepatch : released for CloudLinux 10, in review for CloudLinux 9, in progress for CloudLinux 8. Verify: sysctl user.max_user_namespaces prints 0 when the path is shut. ( how to verify ) Why it matters: one hosting account is enough to reach every tenant on the server. ( why this matters ) How the bug works: a marker that protects shared memory pages is dropped. ( technical details )
2. Oct 23, 2026, 22:12 UTC
   identified
   Kernels with the fix have been released to the beta and rollout channels: - CloudLinux 7 hybrid: kernel-4.18.0-553.177.1.lve.1.el7h - CloudLinux 8: kernel-4.18.0-553.177.1.lve.1.el8 To install it now, first make sure the server runs the latest cloudlinux-release package: CloudLinux 7 hybrid: yum update cloudlinux-release CloudLinux 8: dnf upgrade cloudlinux-release Target versions: - CloudLinux 7 hybrid: cloudlinux-release-7.9-2.18.el7h or newer - CloudLinux 8: cloudlinux-release-8.10-16.el8 or newer Then install the kernel and reboot into it: CloudLinux 7 hybrid: yum clean all && yum update 'kernel*' --enablerepo=cloudlinux-rollout-2-bypass CloudLinux 8: dnf clean all && dnf update 'kernel*' --enablerepo=cloudlinux-rollout-2-bypass reboot To confirm the fix is in the installed kernel, check its changelog for CLKRN-2389 : rpm -q --changelog kernel-core-$(uname -r) | grep CLKRN-2389 CloudLinux 9 and 10: the fix is coming from AlmaLinux, and we will release it as soon as it is available.

Updates as published by CloudLinux (original).