Two further serious Linux kernel vulnerabilities were publicly disclosed in early July 2026: GhostLock (CVE-2026-43499), a use-after-free in the kernel futex priority-inheritance code that lets any unprivileged local user gain root and escape containers, disclosed with a working proof of concept as part of the IonStack research series, and ipv6_frag_escape (CVE-2026-53362), an out-of-bounds write in the IPv6 fragmentation path (__ip6_append_data()) that an unprivileged process can trigger over a UDPv6 socket to corrupt kernel memory and reach root.
Both vulnerabilities were handled with the highest priority. Our entire virtualization and hosting infrastructure was updated as soon as patched kernels were released and all nodes now run fully updated kernels. There are no indications of exploitation on our platform and customer data was never at risk.
We recommend that customers also update the operating systems inside their VPS and dedicated servers. Both issues are local privilege escalations and affect guest systems independently of the host: GhostLock is present in every kernel from 2.6.39 (2011) onwards, and the IPv6 fragmentation defect was introduced in kernel 6.0. On most distributions a standard package update and a reboot are sufficient.
If you run containers (Docker, LXC, Kubernetes) inside your VPS or dedicated server, please treat this update as a priority, as both vulnerabilities allow escape from a container to root on the host system.
Security maintenance of this kind is part of our ongoing commitment to the security of your services. For any questions we are available through the support system.
