Kernel: "Copy Fail", "Dirty Frag" & "GhostLock" CVEs patched

Addendum Jul 20, 2026 2:24 PM AEST

Please note that CloudLinux/Imunify engineers are currently investigating 2x instances of I/O runaway leading to overload into kernel taint, which appears potentially related to the GhostLock patch interacting with Imunify360.

We’re keeping a close eye on operations today, as there was a 2nd instance of this on another machine today with only some of the hallmarks from the 1st instance of it last night. At least 1 more update will be provided.

Edit: Further updates via separate advisory https://the.uptime.business/issues/6a5dfc042b0e94e98e847d0d

Addendum Jul 12, 2026 11:36 PM AEST

Please note we’ve upgraded all CloudLinux kernels to 4.18.0-553.141.2.lve.el8.x86_64 to patch:

“GhostLock” CVE-2026-43499 (CVSS 3.x: 7.8 HIGH) https://nvd.nist.gov/vuln/detail/CVE-2026-43499

Addendum Jul 11, 2026 12:16 AM AEST

We’re slowly testing & rolling out Kernel 4.18.0-553.141.2.lve.el8.x86_64 to patch “GhostLock”.

As this is currently in CloudLinux’s testing release channel we’re ensuring stability through corporate firstly.

Information May 11, 2026 12:00 PM AEST

G’day,

Please note we’ve upgraded CloudLinux kernels to 4.18.0-553.123.2.lve.el8.x86_64 to patch both:

“Copy Fail” CVE-2026-31431 (CVSS 3.x: 7.8 HIGH) https://nvd.nist.gov/vuln/detail/CVE-2026-31431
“Dirty Frag” CVE-2026-43284 / 43500 (7.8 HIGH) https://nvd.nist.gov/vuln/detail/CVE-2026-43284

The upgraded kernels (in runtime via reboot) now take over from KernelCare live patching updates before.

We’ve waited until these were pushed to stable and not subsequently revoked, which is now the case.

Please let us know if you’ve any concerns with regard to these security upgrades and reboots.

Now we’re in the AI era (look up “Project Glasswing” etc), expect more CVEs to drop soon.

Cheers,
Merlot Digital

The Network Crew Pty Ltd (TNC)