On 18 September 2026 CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities (KEV) catalogue: CVE-2025-39964 (AF_ALG crypto sockets), CVE-2026-53266 (ebtables SNAT on bridges), and CVE-2025-39682 (kernel TLS receive path). KEV means confirmed exploitation, not theory. CloudLinux published its status on 7 October and last updated it on 12 October 2026.
All three need local code execution first. On a shared server, every customer with a PHP script already has that, so treat these as root-from-any-account bugs and patch accordingly.
What each CVE does
| CVE | Subsystem | Impact | Precondition |
|---|---|---|---|
| CVE-2025-39964 | AF_ALG crypto socket API | Race between concurrent sendmsg() writers corrupts socket state; a public exploit reportedly reaches root | None beyond local access — the interface is built into the kernel |
| CVE-2026-53266 | Bridge netfilter, ebtables SNAT | ARP sender-address rewrite writes past its buffer: memory corruption or privilege escalation | An ebtables SNAT rule with ARP rewriting, reachable via user namespaces |
| CVE-2025-39682 | Kernel TLS (kTLS) receive | Zero-length record bypasses the record-type check: kernel memory leak or crash | kTLS in use on the connection |
CVE-2025-39964 is the one that matters most for hosts. It affects every CloudLinux branch and has no mitigation: blacklisting the module or adding boot parameters does nothing, because AF_ALG is compiled in.
Which CloudLinux versions are affected
| Version (kernel) | AF_ALG (39964) | ebtables (53266) | kTLS (39682) |
|---|---|---|---|
| CloudLinux 7 (3.10) | Affected | Out of reach by default | Not affected |
| CloudLinux 7h, 8 (4.18) | Affected | Affected | Not affected |
| CloudLinux 8 LTS (5.14 ELS) | Affected | Affected | Affected |
| CloudLinux 9, 9 LTS (5.14) | Affected | Out of reach by default | Affected |
| CloudLinux 10 (6.12) | Affected | Out of reach by default | Affected |
| CloudLinux for Ubuntu 22.04 (5.15) | Affected | Out of reach by default | Not affected |
Patch by branch
Start with uname -r, then follow your stream. An installed kernel you haven't booted into protects nothing.
CloudLinux 7h and 8
The ebtables fix ships in 4.18.0-553.142.1.lve and newer. The AF_ALG kernel was still in staged rollout at the last update, so install the current kernel now and again once the crypto build lands:
yum update kernel
reboot
CloudLinux 9 and 10
CloudLinux 10 is fully fixed from 6.12.0-211.59.1.el10_2. On CloudLinux 9 the current kernel carries the kTLS and ebtables fixes (ebtables from 5.14.0-687.23.1.el9_8). The AF_ALG kernel is still in preparation.
dnf update kernel
reboot
CloudLinux 8 LTS and 9 LTS (TuxCare ELS)
The ebtables fix is in kernel-lts-5.14.0-284.1101.tuxcare.11.els13 and newer. AF_ALG and kTLS kernels are in preparation. On an ELS-subscribed server, run dnf update, then reboot.
CloudLinux 7
No kernel update is planned for the 3.10 line. Livepatching is the only fix path. That's one more reason to move these boxes off the EL7 generation entirely — the CentOS 7 to AlmaLinux migration guide covers the cPanel side.
KernelCare covers most of the gap
On 7 October, livepatches were live for every CVE that affects CloudLinux 7h, 8, 9 LTS, and 10. CloudLinux 9 had kTLS and ebtables livepatches, with AF_ALG in preparation. The CloudLinux 7 AF_ALG livepatch reached the main feed by 12 October.
kcarectl --update
kcarectl --patch-info | grep -E 'CVE-2025-39964|CVE-2026-53266|CVE-2025-39682'
Use --patch-info, not --info. The latter lists no CVEs and tells you nothing here. On 7h, 8, and 10, a livepatch closes the AF_ALG hole now, without waiting for a kernel and a reboot window. That's the practical argument for KernelCare on shared servers. CloudLinux 8 LTS has no livepatch coverage, so plan reboots for that branch.
Mitigate CVE-2026-53266 without a reboot
The ebtables path needs a user namespace. Check whether it's reachable, then close it:
cat /proc/sys/user/max_user_namespaces
sysctl -w user.max_user_namespaces=0
echo 'user.max_user_namespaces = 0' > /etc/sysctl.d/90-cve-2026-53266.conf
This does nothing for CVE-2025-39964, the AF_ALG race. If your earlier bridge-stp-uaf mitigation is still in place, leave it. It's a separate bug.
Are CVE-2025-39964, CVE-2026-53266 and CVE-2025-39682 remotely exploitable?+
Is there a workaround for CVE-2025-39964 on CloudLinux?+
Does disabling user namespaces break cPanel or CloudLinux?+
How do I check if KernelCare has patched these CVEs?+
Will CloudLinux 7 get a patched kernel?+
Next steps
- Compare livepatching with reboot windows across your fleet in live patching hosting fleets.
- Still on CloudLinux 8 LTS without livepatch coverage? Consider moving to CloudLinux OS 10.
- Add livepatching to your servers with a KernelCare license, or get a CloudLinux license for new nodes.