CVE-2026-72389: kernel bridge flaw grants root on CloudLinux 7h and 8

A bug in the Spanning Tree Protocol timers of the Linux kernel network bridge allows an unprivileged local user who can configure a bridge to gain root on the host. It is CVE-2026-72389 (bridge-stp-uaf), CVSS 7.0, classified as Moderate by Red Hat, reported on 5 August 2026 by researchers n132 and sven sze via SSD Secure Disclosure. The vulnerable code has been present in the Linux kernel since at least version 2.6.12 from 2005. For those managing shared hosting this directly affects customers: "local" here means anyone who has gained access to a website through an unpatched plugin. If corruption reaches the kernel, which is shared by all tenants, the result is root across every account on the machine.

Affected CloudLinux versions

According to the CloudLinux advisory, published on 10 September 2026 and updated on 1 October, the vulnerable code is present in all distributed kernels, but is not reachable from a normal hosting account in all cases:

Version	Default exposure	Kernel patch status	Livepatch
CloudLinux 7h	Yes, as shipped	4.18.0-553.157.1.lve.2.el7h, stable rollout from 23/9/2026	Available on main feed
CloudLinux 8	Yes, as shipped	4.18.0-553.157.1.lve.2.el8, stable rollout from 23/9/2026	Available on main feed
CloudLinux 8 LTS (TuxCare ELS)	Yes, as shipped	kernel-lts-5.14.0-284.1101.tuxcare.11.els14, in beta	Not covered by KernelCare on this branch
CloudLinux 7, 9, 9 LTS, 10, Ubuntu 22.04	No, not exposed by default	Follows Red Hat/Canonical, no date	Available on CL9/CL10, to be confirmed on CL9 LTS

A container with elevated networking privileges bypasses the default protection on non-exposed versions: in those cases treat it as exposed until patched or livepatch is applied.

Mitigation without reboot

On CloudLinux 7h, 8 and 8 LTS, where an immediate remedy is needed, apply this rule:

echo 'install bridge /bin/false' > /etc/modprobe.d/bridge-stp-uaf.conf

This only works if the bridge module is not already loaded: verify with lsmod | grep '^bridge '. No reboot is needed if the command returns no output. The rule has no effect on hosts that already perform bridging (Docker with docker0, libvirt, LXC): on those a kernel update or livepatch is required. Use the form install bridge /bin/false, not a simple blacklist bridge, which does not prevent loading on kernel request.

Verification and update

After the update, uname -r must report 4.18.0-553.157.1.lve.2.el8 or .el7h depending on your version. With livepatch available: kcarectl --patch-info | grep CVE-2026-72389. On CL8: yum update 'kernel*' --enablerepo=cloudlinux-updates-testing && reboot; on CL7h: yum update 'kernel*' --enablerepo=cl7h_beta && reboot. The advisory is also tracked on the CloudLinux status page, where further updates are planned.