Kernel Root CVE (CVE-2026-72389)

CVE-2026-72389 (bridge-stp-uaf) is a use-after-free in the Linux kernel's bridge Spanning Tree Protocol timers that lets a local unprivileged user who can configure a network bridge escalate to root. CloudLinux has published a kernel update and mitigation; DirectAdmin server owners running CloudLinux should apply it, and kernels on other distributions should be updated as fixes land.

High 7.8 CVSS 2026-09-10

CloudLinux DirectAdmin

CMD de actualización por defecto

cd /usr/local/directadmin/custombuild && ./build update_versions

Lo que esto significa bajo una licencia de SharedLicense

Any local user with bridge configuration rights can turn that into full root on the host — a serious exposure on container hosts and servers where tenants can create bridges.

CloudLinux specific take on it:


		
			
				
					
						
					
				
			
			
				
					
						bridge-stp-uaf (CVE-2026-72389) local root vulnerability: kernel update and mitigation for CloudLinux - CloudLinux
					
				

				📋 TL;DR — last updated September 10, 2026, 16:20 UTC bridge-stp-uaf (CVE-2026-72389, CVSS 7.0, Moderate per Red Hat) is a vulnerability in the Linux kernel’s bridge Spanning Tree Protocol timers. A local unprivileged user who can configure a network bridge can turn it into root on the host. The...

				
					
						
							
						
					
					blog.cloudlinux.com

Preguntas frecuentes

What is CVE-2026-72389?

It is a use-after-free vulnerability in the Linux kernel's bridge Spanning Tree Protocol timer handling, nicknamed bridge-stp-uaf. A local unprivileged user who can configure a network bridge can exploit it to become root. CloudLinux notes Red Hat rates it Moderate with a CVSS of 7.0.

Who can exploit CVE-2026-72389?

It requires local access and the ability to configure a network bridge — for example, container hosts or servers where tenants can set up bridges. Hosting accounts without bridge capabilities are much less exposed, but the kernel update should still be applied.

How do I fix CVE-2026-72389 on CloudLinux?

Apply CloudLinux's kernel update (or KernelCare live patch if installed) per their advisory, then confirm the running kernel includes the bridge-stp-uaf fix. DirectAdmin components are managed separately with CustomBuild, but the kernel itself comes from the OS vendor.

Is CVE-2026-72389 being exploited in the wild?

No active exploitation has been reported. CloudLinux published the kernel update and a mitigation with a TL;DR dated September 10, 2026, and their disclosure mentions no exploitation.

Referencias

Avisos de seguridad

Avisos relacionados

Exim CVE < 4.100.1

2026-09-18

Security Advisory: LiteSpeed Web Server Enterprise 6.3.7 or later is required

2026-09-18

Acronis Backup for cPanel & Plesk CVE-2026-87886: Local Privilege Escalation

2026-09-17 00:00:00

Comprueba tu sistema en busca de vulnerabilidades

Selecciona tu producto y sistema operativo para ver los comandos de corrección exactos que se aplican a ti.

Comprueba tu sistema