Skip to main content
Sign in

TuxCare Knowledge Base

  1. TuxCare
  2. KernelCare
  3. Articles

KernelCare: CVE-2025-39964 livepatch and kernel fix status for CentOS 7 and CloudLinux 7, 8, 9, and 10

Misael Ramirez
  • Updated

Issue

KernelCare reports that the server is up to date, but the livepatch for CVE-2025-39964 (a race in the AF_ALG crypto socket interface, af_alg_sendmsg) does not appear in the applied patches:

# kcarectl --update
Updates already downloaded
No updates are needed for this kernel
Kernel is safe
# kcarectl --patch-info | grep CVE-2025-39964
#

The CVE is listed as addressed for RHEL 7 and in the CISA Known Exploited Vulnerabilities catalog, so the question is whether, and when, the livepatch or a fixed kernel is available for the server's kernel line.

Environment

  • KernelCare on CentOS 7 (regular kernel or ELS kernel 3.10.0-1160.x.el7.tuxcare.elsN)

  • KernelCare on CloudLinux 7, CloudLinux 7h (hybrid el7h kernel), CloudLinux 8, CloudLinux 9, or CloudLinux 10

  • cPanel or other control panels (not relevant to the fix)

Solution

Status as of 12/10/26. Find your kernel line with uname -r, then follow the matching entry.

  • CentOS 7, regular kernel: the livepatch is in the main feed in patchset K20261009_0018 (09/10/26). Run kcarectl --update.

  • CentOS 7, ELS kernel (uname -r contains el7.tuxcare.els): the KernelCare livepatch is not released yet. The fix is in the kernel package 3.10.0-1160.164.1.el7.tuxcare.els1. Update the kernel to that version or newer, then reboot. If you cannot reboot yet, see the interim mitigation below.

  • CloudLinux 7, regular kernel (3.10.0-962.3.2.lve1.5.x): the livepatch is in the main feed in patchset K20261009_0012 (09/10/26). Run kcarectl --update.

  • CloudLinux 7h (el7h kernel): covered. Patchset K20261006_0014 contains the fix, and kernel packages 4.18.0-553.168.1.lve.el7h and newer have it built in. Run kcarectl --update or update the kernel.

  • CloudLinux 8: the livepatch is available (patchsets K20261006_0013 and K20261008_0009). K20261008_0009 also adds KernelCare support for the 4.18.0-553.157.1.lve.2.el8 kernel (main feed 09/10/26). The kernel package with the fix, kernel-4.18.0-553.168.1.lve.el8, is still in gradual rollout. To install it now, run the update below and reboot:

    dnf update kernel --enablerepo='cloudlinux-rollout-*-bypass'

  • CloudLinux 9: the livepatch is in the main feed since 01/10/26 (patchset K20261001_0002, also included in K20261003_0002).

  • CloudLinux 10: the livepatch is available (released by 30/09/26).

    To check that the livepatch is applied:

    kcarectl --update
kcarectl --patch-info | grep CVE-2025-39964

    KernelCare picks up new patchsets automatically within four hours. kcarectl --update forces the check. If the second command returns nothing, either the patchset has not reached the server yet, or the running kernel already contains the fix. In the second case, the kernel changelog shows it:

    rpm -q --changelog kernel-$(uname -r) | grep CVE-2025-39964

    Interim mitigation, until a livepatch or fixed kernel is installed. Blacklisting the af_alg module with modprobe has no effect, because AF_ALG is built into these kernels. Disabling its initialization at boot does work, and was tested on CloudLinux 8 with LVE, CageFS, and KernelCare. It was not tested on the 3.10 kernels, so try it on one server first.

    grubby --update-kernel=ALL --args="initcall_blacklist=af_alg_init"
reboot

    After the reboot, this command should fail with "[Errno 97] Address family not supported by protocol". Without the parameter it prints nothing:

    python -c 'import socket; socket.socket(38, 5, 0)'

Once the livepatch is applied, the boot parameter is no longer needed for this CVE. Remove it at the next planned reboot, or keep it if nothing on the server uses AF_ALG.

Cause

KernelCare livepatches are built and released separately for each distribution and kernel line, so the status differs between them. The ELS kernel line of CentOS 7 (el7.tuxcare.elsN) is separate from the regular CentOS 7 kernel. The 09/10/26 release for CentOS 7 covers only the regular kernel, so a server on the ELS kernel still has no livepatch.

KernelCare also lists only the patches it loads on top of the running kernel. A fix already compiled into a newer kernel build never appears in kcarectl --patch-info, even though the server is not vulnerable.

Useful Links

Comments

0 comments

Article is closed for comments.