No impact incident

CloudLinux: sock-gettstamp-uaf (CVE-2026-98276): UDP socket use-after-free, local crash, KernelCare status

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Nov 6, 2026, 09:40 UTC
   monitoring
   State as of 2026-11-06, 09:35 UTC. - Published as CVE-2026-98276 by the kernel CNA on 2026-10-06 ( CVE record ). CNA score 7.8 High , AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H . Red Hat: Moderate 7.0 ( AC:H ). - The upstream fix landed in Linux 7.3-rc4 and in all stable lines before any exploitation was reported. This is not a zero-day . - A local user with a normal account can trigger it. It is not reachable from the network. - A working exploit was used against one CloudLinux 8 server on 2026-11-04. The server crashed 12 times. No privilege escalation was seen. No public exploit code found. - CloudLinux 8, 9 and 10 kernels are affected. Red Hat has no fixed kernel for RHEL 7, 8, 9 or 10 and lists no mitigation. Impact confirmed: kernel crash (denial of service) by a local user. We reproduced the crash in-house. Privilege escalation is not reproduced and not shown. The KernelCare livepatch for CloudLinux 8 is released (K20261105_0055, production feed since 2026-11-06 08:50 UTC). Run kcarectl --update . We made it ahead of the vendor. Technical summary The bug is in sock_gettstamp() in net/core/sock.c . This is the kernel handler for the SIOCGSTAMP and SIOCGSTAMPNS ioctls, which return the time a packet arrived. - On first use the handler sets a flag in the socket flags word without the socket lock. - The flag update is not atomic. A bind() on the same UDP socket at the same moment can lose its own update to the same word. - The lost flag is SOCK_RCU_FREE . It tells the kernel to wait for readers before it frees the socket. - Without it, the socket is freed at once on close, while the UDP receive path can still use it. This is a use-after-free. - The fix takes the socket lock in sock_gettstamp() , only when the flag must be set. - Present since Linux 2.6.12, so all supported kernels are affected. Crash signature on the attacked CloudLinux 8 server: - WARNING ... at net/ipv4/af_inet.c:153 and :156 in inet_sock_destruct - then a NULL pointer dereference in udp_destruct_common (socket close) or in __sk_mem_raise_allocated called from __udp_enqueue_schedule_skb (UDP receive) - with kernel.panic_on_oops = 1 each crash rebooted the server What the KernelCare livepatch does - Ports the upstream fix: take the socket lock around the flag update. Small change, no data structure change. - LibCare is out of scope (kernel bug). Mitigation There is no practical mitigation. Install the livepatch where it is released. - No sysctl or kernel option turns the affected code off. Any user who can open a UDP socket can reach it. - A firewall does not help. The trigger is local socket calls and does not pass through iptables or nftables. - An SELinux policy can block the two ioctls, but control panels require SELinux to be disabled on CloudLinux. Not a usable option for most servers. - Restricting or suspending untrusted local accounts lowers the risk until the livepatch is installed. Coverage status, 2026-11-06 Upstream stable: fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3. EL family (RHEL, AlmaLinux, CloudLinux, Rocky, Oracle Linux RHCK) 8, 9 and 10, and RHEL 7: affected. Red Hat: "Affected", no fix, no date. CloudLinux 9 and 10 run AlmaLinux kernels. Debian: fixed. trixie 6.12.113-1 (DSA-6568-1), bookworm 6.1.190-1 (DLA-4841-1) and linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1). Ubuntu: not verified. Livepatch status: - CloudLinux 8 (K20261105_0055): production feed since 2026-11-06 08:50 UTC. Not on ePortal yet. - Debian 13 (K20261024_0026): production feed since 2026-10-26 08:36 UTC, ePortal since 2026-10-28 12:07 UTC. - Debian 12 (K20261102_0001): prod
2. Nov 6, 2026, 16:55 UTC
   monitoring
   This update replaces older statements in this doc where they differ. Privilege escalation is reproduced in-house. We got root on AlmaLinux 8 with the stock kernel 4.18.0-553.el8_10 in about 70 seconds. The exploit is built on the code taken from the attacked server. Treat this CVE as a local privilege escalation, not only a crash. On the attacked CloudLinux 8 server we see crashes only. Root on that server is not shown. CloudLinux 8 livepatch K20261105_0055 is on the production feed since 2026-11-06 08:50 UTC. ePortal: pending. Not yet confirmed against the privilege escalation exploit. A livepatch for RHEL and AlmaLinux 8 is expected. No ETA yet. EL 9 and 10: no decision yet. Correction: "Present since Linux 2.6.12" is not confirmed. The CVE record uses 2.6.12 as a default start point. The real start point is not verified. The affected list from Red Hat (RHEL 7, 8, 9 and 10) does not change.

Updates as published by CloudLinux (original).