{"id":11216,"date":"2026-11-09T21:15:36","date_gmt":"2026-11-10T01:15:36","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=11216"},"modified":"2026-11-09T20:20:08","modified_gmt":"2026-11-10T00:20:08","slug":"cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/","title":{"rendered":"CloudLinux warns of a kernel bug with no workaround and a root exploit"},"content":{"rendered":"<p dir=\"ltr\">An attacker used a Linux kernel flaw on November 4 to crash a CloudLinux 8 server twelve times. That attack caused crashes only. <a href=\"https:\/\/cloudlinux.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CloudLinux<\/a> says its engineers have since turned the same flaw into root access in their own tests, which changes how seriously shared hosts should treat it.<\/p>\n<p dir=\"ltr\">The flaw, tracked as <a href=\"https:\/\/cloudlinux.com\/security\/cve-2026-98276-linux-kernel-udp-socket-flaw-cloudlinux\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CVE-2026-98276<\/a>, lets any local user knock a server over. On shared hosting, that group includes every customer account that can run a program, plus an intruder who has broken into a single vulnerable site. A crash takes every site on the machine offline. Root access would hand over every site, mailbox and database.<\/p>\n<p dir=\"ltr\">The bug is a use-after-free, meaning the kernel keeps using memory after releasing it. A program races a timestamp request against a bind() call on its own UDP socket, and when the two collide, the kernel can free the socket too early. It can\u2019t be triggered over the network. The kernel CVE team published it on October 6 with a CVSS score of 7.8, and the upstream fix already reached Linux 7.3-rc4 and the stable lines before anyone reported an attack, so CloudLinux doesn\u2019t call it a zero-day. <a href=\"https:\/\/hostingdiscussion.com\/news\/red-hat-openshift-4-22-targets-cloud-costs-ai-security-gaps\/\">Red Hat<\/a> rates it lower, at 7.0, since winning the race is hard to repeat. CloudLinux says its own exploit isn\u2019t stable, though it worked several times, and nobody has published exploit code.<\/p>\n<p dir=\"ltr\">Distribution fixes are landing unevenly. CloudLinux 8 has a KernelCare live patch since November 6, and CloudLinux 8 LTS and 9 LTS users can take TuxCare kernels from the stable channel. A fixed kernel for CloudLinux 7 is still in preparation. Debian 12 and 13 have security updates, Ubuntu 22.04\u2019s standard kernel is fixed, and Red Hat lists its releases as affected without a fixed kernel yet.<\/p>\n<p dir=\"ltr\">No mitigation exists, according to <a href=\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-sharpens-focus-on-wordpress-reliability-through-new-investment-in-seahawk\/\">CloudLinux<\/a>. No sysctl setting or boot option disables the code, a firewall can\u2019t see the attack, and CageFS doesn\u2019t help. SELinux could block it, but cPanel &amp; WHM needs SELinux off.<\/p>\n<p dir=\"ltr\">So what can hosts do today? Suspend untrusted accounts, shell access and cron jobs. Then check the kernel log for the crash signature CloudLinux published. A match proves nothing alone, and a clean log doesn\u2019t clear a server, so installing the fixed kernel is the real answer.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An attacker used a Linux kernel flaw on November 4 to crash a CloudLinux 8 server twelve times. That attack caused crashes only. CloudLinux says its engineers have since turned the same flaw into root access in their own tests, which changes how seriously shared hosts should treat it. The flaw, tracked as CVE-2026-98276, lets [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[1353,8708,8709,8710,1452],"class_list":["post-11216","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cloudlinux","tag-cve-2026-98276","tag-kernel-vulnerability","tag-kernelcare-live-patch","tag-shared-hosting"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>CloudLinux warns of a kernel bug with no workaround and a root exploit - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CloudLinux warns of a kernel bug with no workaround and a root exploit - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"An attacker used a Linux kernel flaw on November 4 to crash a CloudLinux 8 server twelve times. That attack caused crashes only. CloudLinux says its engineers have since turned the same flaw into root access in their own tests, which changes how seriously shared hosts should treat it. The flaw, tracked as CVE-2026-98276, lets [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-10T01:15:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-10T00:20:08+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/\",\"name\":\"CloudLinux warns of a kernel bug with no workaround and a root exploit - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-11-10T01:15:36+00:00\",\"dateModified\":\"2026-11-10T00:20:08+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CloudLinux warns of a kernel bug with no workaround and a root exploit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CloudLinux warns of a kernel bug with no workaround and a root exploit - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/","og_locale":"en_US","og_type":"article","og_title":"CloudLinux warns of a kernel bug with no workaround and a root exploit - Web Hosting News","og_description":"An attacker used a Linux kernel flaw on November 4 to crash a CloudLinux 8 server twelve times. That attack caused crashes only. CloudLinux says its engineers have since turned the same flaw into root access in their own tests, which changes how seriously shared hosts should treat it. The flaw, tracked as CVE-2026-98276, lets [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/","og_site_name":"Web Hosting News","article_published_time":"2026-11-10T01:15:36+00:00","article_modified_time":"2026-11-10T00:20:08+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/","url":"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/","name":"CloudLinux warns of a kernel bug with no workaround and a root exploit - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-11-10T01:15:36+00:00","dateModified":"2026-11-10T00:20:08+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/cloudlinux-warns-of-a-kernel-bug-with-no-workaround-and-a-root-exploit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"CloudLinux warns of a kernel bug with no workaround and a root exploit"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":8,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11216","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=11216"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11216\/revisions"}],"predecessor-version":[{"id":11217,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11216\/revisions\/11217"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=11216"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=11216"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=11216"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}