RtabRace (CVE-2026-68138): unprivileged local users can crash the host — mitigation and kernel update for CloudLinux

A public proof-of-concept for RtabRace (CVE-2026-68138) was released on August 12, 2026 by the researcher A. Ramos. It is a race condition in the Linux kernel’s traffic-control (TC) networking subsystem. An unprivileged local user who can create a user namespace can trigger it.

The bug is in the Linux kernel itself, not in anything CloudLinux ships. It reaches every kernel carrying a 2019 change to the traffic-control code, which puts RHEL, AlmaLinux, Rocky and CloudLinux in the same position, along with several Debian and Ubuntu releases. This advisory covers the CloudLinux side. If you run other distributions next to your CloudLinux fleet, treat them as in scope and follow those vendors’ advisories.

We reproduced the vulnerability in our lab across the CloudLinux line-up. The researcher’s full chain to root ran on stock Ubuntu 22.04 with kernel address randomization disabled. On CloudLinux, what we saw instead was a reliable crash. Every attempt corrupted kernel state badly enough to fault later. On a shared host that is a serious availability problem: an unprivileged local user can panic the server on demand, repeatably, whether or not they ever gain a privilege, using nothing more than the published binary.

And “local” here does not mean an employee or a customer you trust. On a shared server the local user is whoever just got into one of the sites you host through an outdated plugin, and a crash they trigger takes every other account on the box down with them.

Affected CloudLinux versions

Exposure to the published exploit is a property of configuration, not just of the CloudLinux version. The table below shows whether the exploit can run on each version’s stock configuration. It does not, by itself, tell you whether a given server is exposed because that also depends on whether untrusted local users have shell access and whether unprivileged user namespaces have been left enabled. Use the self-check to decide per server.

^† CloudLinux for Ubuntu 22.04 runs the stock Ubuntu kernel with a CloudLinux sysctl overlay at /etc/sysctl.d/90-cloudlinux.conf that sets user.max_user_namespaces=0 at boot, so the exploit fails at its first system call. This differs from raw Ubuntu 22.04, which has no such overlay and where the researcher achieved root. Only hosts where that overlay was manually removed are exposed. The durable kernel fix arrives from Canonical through apt, not a CloudLinux stream.

Two platforms need action today: CloudLinux 8 and CloudLinux 7 Hybrid, which ship with unprivileged user namespaces enabled by default. Everything newer ships with them disabled by default, so the published exploit fails before it touches any vulnerable code.

A KernelCare livepatch will close the vulnerability without a reboot on every affected version once it reaches the feeds.

Am I exposed?

Run these two checks on a server. They take a few seconds and need no special privileges.

# 1) Are unprivileged user namespaces enabled?
sysctl user.max_user_namespaces           # RHEL-family: 0 = safe, non-zero = exposed
sysctl kernel.unprivileged_userns_clone   # Debian/Ubuntu: 0 = safe, 1 = exposed

# 2) Can an unprivileged shell actually create one?
unshare -Urn true; echo "exit=$?"         # 0 = exposed, non-zero = safe

A server is exposed to the published exploit when all three of these are true:

• untrusted local users have shell access,
• the sysctl in check 1 is non-zero,
• and check 2 exits 0.

On stock CloudLinux 8 and CloudLinux 7 Hybrid the sysctl is non-zero, so those hosts are exposed until you apply the mitigation, a patched kernel, or the livepatch.

On stock CloudLinux 9, CloudLinux 10, the LTS variants and CloudLinux for Ubuntu 22.04 the sysctl is already 0 and check 2 fails, so there is nothing to do unless someone raised it manually.

Is there a mitigation?

Yes. On CloudLinux 8 and CloudLinux 7 Hybrid, apply it now on any server you cannot reboot into the patched kernel right away. It takes effect without a reboot.

Disable unprivileged user namespaces

echo 'user.max_user_namespaces = 0' > /etc/sysctl.d/99-rtabrace.conf
sysctl -p /etc/sysctl.d/99-rtabrace.conf

This takes effect immediately and needs no reboot.

Compatibility. Disabling unprivileged user namespaces breaks tools that rely on them: rootless Podman and Docker, bwrap and Flatpak sandboxing, the Chromium sandbox, and some CI runners. Typical shared-hosting workloads do not use them. cPanel, Plesk and DirectAdmin stacks, the PHP, Node.js, Python and Ruby selectors, and ordinary customer sites are unaffected by this change. On developer and container hosts, weigh it before applying.

Revert once a patched kernel or the livepatch is in place:

rm /etc/sysctl.d/99-rtabrace.conf
sysctl --system

If you cannot disable user namespaces

Two narrower options exist for hosts that genuinely need unprivileged user namespaces.

Block the traffic-control modules the race runs through, where you do not use traffic control:

sudo tee /etc/modprobe.d/99-rtabrace.conf > /dev/null <<'EOF'
install cls_flower /bin/true
install act_police /bin/true
EOF
lsmod | grep -E 'cls_flower|act_police'   # must be empty for this to help

This only helps if the modules are not already loaded and are genuinely unused. Do not apply it on hosts running Cilium, Calico with eBPF or tc datapaths, Kubernetes or OpenShift network plugins that program tc filters, or any tc QoS shaping. It is weaker than the sysctl, because a host that later loads cls_flower legitimately is exposed again.

Drop the CAP_NET_ADMIN capability on container workloads that do not need it. The sysctl closes the unprivileged-user-namespace path only. A container process that already holds CAP_NET_ADMIN in its own network namespace can drive the race regardless (--cap-drop=NET_ADMIN in Docker, securityContext.capabilities.drop in Kubernetes, CapabilityBoundingSet= in systemd).

The mitigation does not close the underlying bug. It removes the path the current public exploit uses to reach it. A process that already holds CAP_NET_ADMIN can still trigger the race. The patched kernel or the KernelCare livepatch is the durable fix.

Update instructions

Stream 1: CloudLinux 8 and CloudLinux 7 Hybrid kernel

To install the patched kernel now, from the testing channel:

# CloudLinux 8
yum update 'kernel*' --enablerepo=cloudlinux-updates-testing
reboot

# CloudLinux 7 Hybrid
yum update 'kernel*' --enablerepo=cl7h_beta
reboot

Or wait for the staged rollout to reach your server, at which point the standard update path installs it:

yum update 'kernel*'
reboot

After the reboot, uname -r should report 4.18.0-553.150.1.lve.1.el8 on CloudLinux 8 or 4.18.0-553.150.1.lve.1.el7h on CloudLinux 7 Hybrid.

Stream 2: AlmaLinux kernel (CloudLinux 9 and CloudLinux 10)

Once fixed kernels reach the production repositories, the standard update path applies:

dnf update 'kernel*'
reboot

On servers where you would rather not wait for the vendor kernel, the KernelCare livepatch closes the vulnerability with no reboot as soon as it reaches the feeds.

Stream 3: KernelCare livepatch

The livepatch applies the fix to the running kernel, with no reboot and no maintenance window. Subscribed servers receive it automatically on the next scheduled run. To pull it immediately once it is in the feed:

kcarectl --update

Once the livepatch is in place, the mitigation is no longer needed on that server. See Is there a mitigation? for how to revert it.

Stream 4: CloudLinux 8 LTS and CloudLinux 9 LTS (TuxCare ELS)

Verify the stock lock is in place with sysctl user.max_user_namespaces (expected 0).

How to verify you are patched

For the mitigation, confirm unprivileged user namespaces are off:

sysctl user.max_user_namespaces      # expected 0
unshare -Urn true; echo "exit=$?"    # expected non-zero

For a kernel update, compare uname -r against the target version in the relevant stream above. On CloudLinux 8 the patched kernel is 4.18.0-553.150.1.lve.1.el8; on CloudLinux 7 Hybrid it is 4.18.0-553.150.1.lve.1.el7h.

For the KernelCare livepatch, once one has shipped:

kcarectl --patch-info | grep CVE-2026-68138

Use --patch-info for this. kcarectl --info does not list individual CVEs and will come back empty even on a patched server.

The rest of this advisory is background for readers who want it: how the attack plays out on a shared host, and the technical detail of the underlying bug. Neither is required to apply the fix above.

Why this matters on a shared host

On a multi-tenant CloudLinux host (a shared cPanel or Plesk box, a container fleet with tenant-controlled containers, a VPS that gives customers shell access, a CI runner that executes customer code), the chain is short and every step after the first is free.

1. A site on the server is compromised. An outdated plugin, theme, or CMS gives an attacker code execution as an unprivileged web process, confined to one account. No breach of your infrastructure and no stolen credentials are needed.
2. From that process, they open a user namespace to get network-admin rights. On stock CloudLinux 8 and CloudLinux 7 Hybrid this is allowed by default. unshare(CLONE_NEWUSER|CLONE_NEWNET) hands an unprivileged user the CAP_NET_ADMIN capability inside a private network namespace, which is all the attack needs. The capability is never required on the host itself.
3. They trigger the race in the traffic-control classifier. Two concurrent requests naming the same internal rate table race each other, and the kernel frees the same object twice. Kernel heap memory is now corrupted.
4. The host goes down. In our testing this is where it reliably ends: the corrupted state faults the kernel later, typically while a network namespace is being torn down after the attacking process has already exited. The machine panics or hangs. On stock Ubuntu 22.04 with address randomization disabled, the researcher chained the same corruption into a root shell. We did not reach root on any CloudLinux kernel, though we do not treat that as a guarantee.
5. On a shared host, one compromised account’s crash is everyone’s outage. The attacker does not need to reach root to hurt you. Repeatedly panicking the box is an availability incident for every other account on it, and it takes no skill beyond running the published binary.

With unprivileged user namespaces disabled, step 2 fails and the chain stops there. A compromised website stays a compromised website: one account to clean up instead of a server to bring back online.

Technical details of the bug

The kernel keeps a process-global list of traffic-control rate tables, qdisc_rtab_list, managed by qdisc_get_rtab() and qdisc_put_rtab() with a plain, non-atomic reference count. Neither the list nor the count had a lock of its own. The serialization was incidental: every caller used to hold the global RTNL mutex.

A 2019 change to the kernel (commit 470502de5bdb, first in Linux 5.1) removed that guarantee for the flower classifier, which is allowed to run without RTNL held. A request to install a flower filter with a police action now reaches the rate-table helpers with no lock in place. Two such requests, issued concurrently and naming the same rate table, race the list walk against the insert and the non-atomic reference-count decrement against a concurrent increment. The result is a use-after-free or double-free of a struct qdisc_rate_table object on the kernel heap.

Because that list is global rather than per-network-namespace, requests coming from separate network namespaces still race the same object. That is what puts the bug in reach of an unprivileged user: a user namespace grants CAP_NET_ADMIN inside a private network namespace, and that is enough to send the requests. The upstream fix (f43ee0c0730d, in mainline 7.2-rc5, backported to the stable 7.1.y line in 7.1.6) adds a dedicated spinlock and takes it across both the list walk and the reference-count update.

References

• CVE record: CVE-2026-68138
• Red Hat CVE page: CVE-2026-68138
• Public proof-of-concept and write-up, A. Ramos, August 12 2026: github.com/aramosf/CVE-2026-68138
• Upstream fix, mainline 7.2-rc5: commit f43ee0c0730d, “net/sched: serialize qdisc_rtab_list against concurrent get/put”
• Stable 7.1.y backport, Linux 7.1.6: commit fb29e1b41052
• Bug-introducing commit, Linux 5.1: commit 470502de5bdb, “net: sched: unlock rules update API”