CVE-2026-98276: Linux kernel UDP vulnerability leads to root on CloudLinux
Race condition in Linux kernel UDP socket code: exploited on 4 November on CloudLinux 8 server. No mitigation available, only patching or livepatch.
UptimeMag editorial team · 8 November 2026 · 2 min read
CloudLinux issued an advisory on 7 November regarding CVE-2026-98276, a race condition in the Linux kernel's UDP socket code. Those managing shared hosting need to know this immediately: the vulnerability allows any local user—that is, any account capable of running a programme on the server—to crash the kernel or obtain root privileges.
CVE-2026-98276 has a CVSS score of 7.0, classified as Moderate by Red Hat, whilst NVD rates it 7.8, High, according to the kernel CNA. CloudLinux engineers have reproduced both the crash and privilege escalation to root; on 4 November an exploit struck a CloudLinux 8 server, where only crashes were observed, and no exploit code is currently public. The CVE was published on 6 October, so nearly a month passed before the first observed attack.
Affected versions and patch status
| Version | Kernel | Kernel patch | KernelCare livepatch |
|---|---|---|---|
| CloudLinux 7 | 3.10 | in preparation | not yet |
| CloudLinux 7h | 4.18 | 4.18.0-553.184.1.lve.1, gradual rollout | not yet |
| CloudLinux 8 | 4.18 | 4.18.0-553.184.1.lve.1, gradual rollout | available from 6/11 at 08:50 UTC |
| CloudLinux 8 LTS | 5.14 (TuxCare ELS) | kernel-lts els17, stable channel from 2/11 | not available |
| CloudLinux 9 | 5.14 | 5.14.0-687.66.2.el9_8, AlmaLinux test repo | in preparation |
| CloudLinux 9 LTS | 5.14 (TuxCare ELS) | kernel-lts els17, stable channel | not available |
| CloudLinux 10 | 6.12 | 6.12.0-211.74.2.el10_2, AlmaLinux test repo | in preparation |
| CloudLinux for Ubuntu 22.04 | 5.15 | via Canonical, under review | not yet |
Red Hat lists RHEL 9 and 10 kernels as affected and has not yet released a patch; CloudLinux 9 and 10 therefore receive the fix from AlmaLinux's test repository, not yet moved to production.
No mitigation available
The critical point is that no temporary workaround exists. A firewall will not intercept anything because the attack consists of system calls from a programme to the local kernel, not network traffic. SELinux could block the sequence, but cPanel & WHM requires it to be disabled. The only risk reduction, not elimination, is to restrict shell, cron, and applications from untrusted accounts until the patch is installed.
To verify if the livepatch is active:
kcarectl --patch-info | grep CVE-2026-98276
To check whether a server has already been hit by the 4 November exploit, read the previous boot log:
journalctl -k -b -1 | grep -E 'inet_sock_destruct|udp_destruct_common|__sk_mem_raise_allocated|__udp_enqueue_schedule_skb'
On a server with untrusted accounts and CloudLinux 7h or 8 still awaiting rollout, force the patch with:
yum update cloudlinux-release
yum update kernel --enablerepo=cloudlinux-rollout-10-bypass
reboot
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50).