सुरक्षा सलाह पर वापस जाएँ
Kernel Root CVE (CVE-2026-72389)
CVE-2026-72389 (bridge-stp-uaf) is a use-after-free in the Linux kernel's bridge Spanning Tree Protocol timers that lets a local unprivileged user who can configure a network bridge escalate to root. CloudLinux has published a kernel update and mitigation; DirectAdmin server owners running CloudLinux should apply it, and kernels on other distributions should be updated as fixes land.
High
7.8 CVSS
CloudLinux
DirectAdmin
डिफ़ॉल्ट अपडेट कमांड
cd /usr/local/directadmin/custombuild && ./build update_versionsSharedLicense लाइसेंस के तहत इसका अर्थ
Any local user with bridge configuration rights can turn that into full root on the host — a serious exposure on container hosts and servers where tenants can create bridges.
CloudLinux specific take on it:
bridge-stp-uaf (CVE-2026-72389) local root vulnerability: kernel update and mitigation for CloudLinux - CloudLinux
📋 TL;DR — last updated September 10, 2026, 16:20 UTC bridge-stp-uaf (CVE-2026-72389, CVSS 7.0, Moderate per Red Hat) is a vulnerability in the Linux kernel’s bridge Spanning Tree Protocol timers. A local unprivileged user who can configure a network bridge can turn it into root on the host. The...
blog.cloudlinux.com
अक्सर पूछे जाने वाले प्रश्न
What is CVE-2026-72389?
It is a use-after-free vulnerability in the Linux kernel's bridge Spanning Tree Protocol timer handling, nicknamed bridge-stp-uaf. A local unprivileged user who can configure a network bridge can exploit it to become root. CloudLinux notes Red Hat rates it Moderate with a CVSS of 7.0.
Who can exploit CVE-2026-72389?
It requires local access and the ability to configure a network bridge — for example, container hosts or servers where tenants can set up bridges. Hosting accounts without bridge capabilities are much less exposed, but the kernel update should still be applied.
How do I fix CVE-2026-72389 on CloudLinux?
Apply CloudLinux's kernel update (or KernelCare live patch if installed) per their advisory, then confirm the running kernel includes the bridge-stp-uaf fix. DirectAdmin components are managed separately with CustomBuild, but the kernel itself comes from the OS vendor.
Is CVE-2026-72389 being exploited in the wild?
No active exploitation has been reported. CloudLinux published the kernel update and a mitigation with a TL;DR dated September 10, 2026, and their disclosure mentions no exploitation.
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें