Linux Kernel Security Alert: GhostLock, Bad Epoll, Januscape and OVSwrap

Several serious Linux kernel vulnerabilities were disclosed during July 2026. These issues are particularly important for hosting servers, multi-user environments, container platforms and KVM virtualization hosts.

The vulnerabilities covered in this advisory are:

• CVE-2026-43499: GhostLock
• CVE-2026-46242: Bad Epoll
• CVE-2026-53359: Januscape
• CVE-2026-64531: OVSwrap

Depending on the operating system, kernel version and enabled modules, these vulnerabilities may allow an unprivileged process to gain root access, escape from a container, escape from a virtual machine or crash the physical host.

Although these are primarily local vulnerabilities, they remain highly relevant to internet-facing hosting servers. An attacker who compromises a website, plugin, CMS installation or customer account may already have sufficient local access to attack the underlying kernel.

Vulnerability Overview

Vulnerability	Main impact	Most relevant systems
GhostLock: CVE-2026-43499	Local root escalation and container escape	Multi-tenant, multi-user and container servers
Bad Epoll: CVE-2026-46242	Local root escalation	Newer Enterprise Linux and Ubuntu kernel streams
Januscape: CVE-2026-53359	KVM guest-to-host escape and host crash	KVM hypervisors and servers exposing /dev/kvm
OVSwrap: CVE-2026-64531	Local root escalation through Open vSwitch	Systems containing an affected Open vSwitch kernel module

GhostLock: CVE-2026-43499

GhostLock is a use-after-free vulnerability in the Linux kernel’s real-time mutex and futex priority-inheritance code.

An unprivileged local process may exploit the vulnerability to gain root privileges. The same vulnerability may also be used from inside a container to escape and compromise the host.

No special Linux capabilities are required, and public exploitation details are available.

There is no practical configuration-based mitigation. A patched kernel or a verified livepatch is required.

AlmaLinux, Rocky Linux and RHEL-Compatible Systems

GhostLock affects the supported AlmaLinux 8, 9 and 10 kernel branches.

The following AlmaLinux kernels include the correction:

Operating system	Minimum patched kernel
AlmaLinux 8	4.18.0-553.141.2.el8_10
AlmaLinux 9	5.14.0-687.24.1.el9_8
AlmaLinux 10	6.12.0-211.32.1.el10_2

Rocky Linux and RHEL administrators should install the latest kernel available from their respective vendor repositories rather than installing packages from another distribution.

CloudLinux

GhostLock affects supported CloudLinux kernel streams.

Administrators should install the latest CloudLinux kernel or confirm that KernelCare has applied a livepatch covering:

CVE-2026-43499

Check KernelCare coverage:

kcarectl --update
kcarectl --patch-info | grep CVE-2026-43499

Oracle Linux

Oracle Linux systems may run either:

• Red Hat Compatible Kernel: RHCK
• Unbreakable Enterprise Kernel: UEK

Oracle has published security updates for affected RHCK and UEK kernel streams.

Identify the active Oracle Linux kernel:

cat /etc/oracle-release
uname -r
rpm -q kernel kernel-core kernel-uek kernel-uek-core

A running kernel containing uek is an Unbreakable Enterprise Kernel.

Install the latest kernel from the appropriate Oracle Linux repository and reboot. RHCK and UEK versions must not be compared directly because they use different package names and version numbering.

Ubuntu

Canonical rates GhostLock as a High-severity vulnerability.

As of 5 August 2026, the standard Ubuntu kernel status includes:

Ubuntu release	Status
Ubuntu 26.04 LTS	Fixed
Ubuntu 24.04 LTS	Fixed
Ubuntu 22.04 LTS	Update in progress
Ubuntu 20.04 LTS	Update in progress

Ubuntu provides several kernel variants, including generic, Hardware Enablement, cloud-optimized, low-latency, real-time and FIPS kernels.

The status may differ between kernel variants. Administrators must check the exact installed package rather than relying only on the Ubuntu release number.

uname -r
dpkg -S /boot/vmlinuz-$(uname -r)

Install all available updates and reboot:

apt update
apt full-upgrade -y
reboot

Where Ubuntu Livepatch is enabled, confirm that this specific CVE is covered:

canonical-livepatch refresh
canonical-livepatch status --verbose

Bad Epoll: CVE-2026-46242

Bad Epoll is a race condition and use-after-free vulnerability in the Linux kernel’s epoll event-notification subsystem.

An unprivileged process may trigger the vulnerable condition and convert it into arbitrary kernel memory access and root-level execution.

This issue is particularly relevant to multi-tenant servers because epoll is a core Linux facility used by web servers, PHP workers, databases and many other services.

There is no practical runtime mitigation because epoll cannot be disabled on a functioning Linux server. A patched kernel or verified livepatch is required.

AlmaLinux

Bad Epoll affects:

• AlmaLinux 9
• AlmaLinux 10

AlmaLinux 8 is not affected.

The correction is included in:

Operating system	Minimum patched kernel
AlmaLinux 9	5.14.0-687.23.1.el9_8
AlmaLinux 10	6.12.0-211.31.1.el10_2

The newer GhostLock-patched kernels also include the Bad Epoll fix.

CloudLinux

The affected CloudLinux platforms include:

• CloudLinux 9
• CloudLinux 9 LTS
• CloudLinux 10

CloudLinux 7 and CloudLinux 8 kernel streams are not affected by this specific vulnerability.

Verify KernelCare coverage:

kcarectl --patch-info | grep CVE-2026-46242

Oracle Linux

Oracle has published Bad Epoll updates for affected Oracle Linux 9 and 10 RHCK or UEK kernel streams.

Install all current Oracle Linux updates and confirm that the server boots into the updated RHCK or UEK kernel.

Ubuntu

Canonical rates Bad Epoll as High severity.

The standard Ubuntu kernel status as of 5 August 2026 includes:

Ubuntu release	Status
Ubuntu 26.04 LTS	Fixed
Ubuntu 24.04 LTS	Update in progress
Ubuntu 22.04 LTS	Not affected
Ubuntu 20.04 LTS	Not affected

Specialized Ubuntu kernel variants may have a different status.

Identify the exact kernel package:

uname -r
dpkg -S /boot/vmlinuz-$(uname -r)

Install all currently available Ubuntu updates:

apt update
apt full-upgrade -y

Reboot where a kernel update has been installed:

reboot

Januscape: CVE-2026-53359

Januscape is a vulnerability in the Linux kernel’s KVM/x86 memory-management code.

Its most serious attack path allows a malicious virtual machine to escape from the guest and execute commands as root on the physical virtualization host.

The vulnerability may also allow a malicious guest to crash the host kernel, affecting all virtual machines running on the server.

Januscape affects Intel and AMD x86 virtualization. Servers that do not normally host virtual machines may still be exposed where an unprivileged process can access /dev/kvm.

Check for KVM Exposure

lsmod | grep '^kvm'
ls -l /dev/kvm 2>/dev/null

AlmaLinux, CloudLinux and RHEL-Compatible Systems

Januscape affects applicable KVM-enabled kernel streams across AlmaLinux, CloudLinux and other RHEL-compatible systems.

The newer AlmaLinux GhostLock kernels listed earlier also include the Januscape correction.

Administrators should install the latest vendor kernel and reboot.

Oracle Linux

Oracle has published Januscape updates for affected RHCK and UEK kernel streams.

The correction must be applied to the physical KVM host. Updating only the guest operating systems does not protect the hypervisor.

Oracle Linux Virtualization Manager and other KVM hosts should be updated through the appropriate Oracle Linux repositories.

Ubuntu

Canonical states that Januscape affects Ubuntu on Intel and AMD x86 systems where nested KVM virtualization is enabled.

Check whether nested virtualization is active:

grep . /sys/module/kvm_{amd,intel}/parameters/nested 2>/dev/null

A value of 1 or Y indicates that nested virtualization is enabled.

Where nested virtualization is not required, it may be disabled temporarily:

echo 'options kvm_amd nested=0' \
> /etc/modprobe.d/disable-kvm-nesting.conf

echo 'options kvm_intel nested=0' \
>> /etc/modprobe.d/disable-kvm-nesting.conf

Reboot the server or safely reload the relevant KVM module.

This mitigation does not replace the required kernel update.

Temporary Mitigation for Non-Virtualization Servers

On a server that does not use KVM virtualization, prevent the hardware-specific modules from loading:

printf 'install kvm_intel /bin/false\ninstall kvm_amd /bin/false\n' \
> /etc/modprobe.d/disable-kvm.conf

Do not unload or block KVM modules on a server that is currently running virtual machines.

OVSwrap: CVE-2026-64531

OVSwrap is a Linux kernel vulnerability in the Open vSwitch action-validation code.

An unprivileged local process may exploit the vulnerable kernel module to gain root access.

Open vSwitch does not need to be configured or actively running. The vulnerable module may be loaded automatically when a specially crafted request is made.

A public exploit is available.

Check Whether Open vSwitch Is Available

find /lib/modules/$(uname -r) \
-type f -name 'openvswitch.ko*' 2>/dev/null

Check whether it is currently loaded:

lsmod | grep '^openvswitch'

The vulnerability exists in the kernel module. Checking only whether the Open vSwitch userspace package is installed is not sufficient.

AlmaLinux, Rocky Linux, RHEL and CloudLinux

OVSwrap affects portions of the Enterprise Linux 9 and 10 kernel families.

Affected servers should install the latest vendor kernel or confirm that an applicable KernelCare livepatch has been applied.

kcarectl --patch-info | grep CVE-2026-64531

Oracle Linux

Oracle Linux administrators should check whether the Open vSwitch module is available in the active RHCK or UEK kernel.

Install all current Oracle Linux kernel security updates and apply the temporary module mitigation where Open vSwitch is not required.

Ubuntu

Ubuntu servers should be treated as potentially exposed where the running kernel contains the Open vSwitch module and the installed package has not been confirmed as patched.

Identify the running kernel package:

uname -r
dpkg -S /boot/vmlinuz-$(uname -r)

Check for the module:

find /lib/modules/$(uname -r) \
-type f -name 'openvswitch.ko*' 2>/dev/null

Install all currently available Ubuntu security updates.

Temporary OVSwrap Mitigation

On a server that does not use Open vSwitch, prevent the module from loading:

echo 'install openvswitch /bin/false' \
> /etc/modprobe.d/ovswrap.conf

If the module is already loaded and is not in use:

modprobe -r openvswitch

On Ubuntu, rebuild the initial RAM filesystem:

update-initramfs -u

On RHEL-compatible and Oracle Linux systems:

dracut -f

Do not apply this mitigation to virtualization, networking or container environments that genuinely depend on Open vSwitch.

Updating AlmaLinux, CloudLinux, Rocky Linux and RHEL-Compatible Systems

Update and reboot. Check the running kernel with uname -r (and rpm -q kernel kernel-core kernel-uek on Oracle Linux, dpkg -S /boot/vmlinuz-$(uname -r) on Ubuntu); a livepatch counts only if it lists the CVE.

Updating Oracle Linux

Install all available Oracle Linux updates:

dnf clean all
dnf update -y

Review installed RHCK and UEK kernels:

rpm -q kernel kernel-core kernel-uek kernel-uek-core

Check the default boot kernel:

grubby --default-kernel

Reboot and verify:

reboot

uname -r

Updating Ubuntu

Identify the Ubuntu release and running kernel package:

cat /etc/os-release
uname -r
dpkg -S /boot/vmlinuz-$(uname -r)

Install all available updates:

apt update
apt full-upgrade -y

Check whether a reboot is required:

test -f /var/run/reboot-required \
&& cat /var/run/reboot-required

Reboot and verify:

reboot

uname -r

The security status of the generic Ubuntu kernel cannot automatically be applied to Hardware Enablement, cloud-optimized, low-latency, real-time or FIPS kernel variants.

Post-Update Verification

After applying updates, verify the operating system and active kernel:

cat /etc/os-release
uname -r

Check whether KVM or Open vSwitch modules remain loaded:

lsmod | grep -E '^(kvm|openvswitch)'

On KernelCare-enabled systems:

kcarectl --patch-info \
| grep -E \
'CVE-2026-43499|CVE-2026-46242|CVE-2026-53359|CVE-2026-64531'

On Ubuntu systems using Livepatch:

canonical-livepatch status --verbose

EuroVPS Recommendations

EuroVPS recommends that administrators of Linux hosting and virtualization servers:

1. Verify KernelCare or Ubuntu Livepatch coverage individually for each CVE.
2. Disable KVM or nested virtualization where it is not required.
3. Block the Open vSwitch module where it is present but not required.
4. Investigate compromised websites or user accounts, as kernel patching does not remove an existing compromise.

Control panels such as cPanel and Plesk do not replace the underlying operating-system kernel. Kernel updates must still be installed through the operating-system vendor or an approved livepatch provider.

Need Assistance?

If your server is managed by EuroVPS, open a ticket: we check exposure, apply the updates, coordinate the reboot and review the server for signs of compromise.