An attacker used a Linux kernel flaw on November 4 to crash a CloudLinux 8 server twelve times. That attack caused crashes only. CloudLinux says its engineers have since turned the same flaw into root access in their own tests, which changes how seriously shared hosts should treat it.
The flaw, tracked as CVE-2026-98276, lets any local user knock a server over. On shared hosting, that group includes every customer account that can run a program, plus an intruder who has broken into a single vulnerable site. A crash takes every site on the machine offline. Root access would hand over every site, mailbox and database.
The bug is a use-after-free, meaning the kernel keeps using memory after releasing it. A program races a timestamp request against a bind() call on its own UDP socket, and when the two collide, the kernel can free the socket too early. It can’t be triggered over the network. The kernel CVE team published it on October 6 with a CVSS score of 7.8, and the upstream fix already reached Linux 7.3-rc4 and the stable lines before anyone reported an attack, so CloudLinux doesn’t call it a zero-day. Red Hat rates it lower, at 7.0, since winning the race is hard to repeat. CloudLinux says its own exploit isn’t stable, though it worked several times, and nobody has published exploit code.
Distribution fixes are landing unevenly. CloudLinux 8 has a KernelCare live patch since November 6, and CloudLinux 8 LTS and 9 LTS users can take TuxCare kernels from the stable channel. A fixed kernel for CloudLinux 7 is still in preparation. Debian 12 and 13 have security updates, Ubuntu 22.04’s standard kernel is fixed, and Red Hat lists its releases as affected without a fixed kernel yet.
No mitigation exists, according to CloudLinux. No sysctl setting or boot option disables the code, a firewall can’t see the attack, and CageFS doesn’t help. SELinux could block it, but cPanel & WHM needs SELinux off.
So what can hosts do today? Suspend untrusted accounts, shell access and cron jobs. Then check the kernel log for the crash signature CloudLinux published. A match proves nothing alone, and a clean log doesn’t clear a server, so installing the fixed kernel is the real answer.
