SakerCP SKSA-2026-002 Linux kernel (ZDI-CAN-33367 and PwnEscape)
- Published
- 2026-10-24
- Updated
- 2026-10-24
- Component
- Linux kernel (ZDI-CAN-33367 and PwnEscape)
- Severity
- Critical
- Status
- Waiting for the vendor's fix
- CVE
- CVE-2026-99999
- Affected
- Servers running SakerCP on CloudLinux 8 or 9 where ordinary users can create user namespaces (user.max_user_namespaces other than 0). CloudLinux closes them by default on servers installed since mid-2024.
Summary
Two Linux kernel flaws let a local user reach root: ZDI-CAN-33367 (no CVE yet, public exploit) rewrites files the user can only read, and CVE-2026-99999 (PwnEscape) corrupts kernel memory. On a hosting server, a single account is enough to reach every other one. On servers without virtual machines, both are only exploitable if ordinary users can create user namespaces.
Details
There is no fixed kernel for CloudLinux 9 yet: the fix comes from AlmaLinux. The mitigation is to turn off user namespaces for ordinary users (user.max_user_namespaces = 0); no SakerCP feature needs them. The next SakerCP version writes this setting to the system and the security advisor checks it as critical, so it does not depend only on the CloudLinux configuration.
What to do
Check now: sysctl user.max_user_namespaces must print 0. If it does not: sysctl -w user.max_user_namespaces=0 and save the line user.max_user_namespaces = 0 to a file in /etc/sysctl.d/ (no reboot). When the fixed kernel ships: dnf upgrade 'kernel*' and reboot. This advisory will be updated then.
Timeline
- CVE-2026-99999 (PwnEscape) is disclosed.
- CloudLinux publishes ZDI-CAN-33367, with a public exploit and the mitigation.
- Our daily watch picks it up from the CloudLinux status page. The lab was already mitigated (user.max_user_namespaces = 0); SakerCP now enforces the setting and checks it.