Overview
Linux maintainer Greg Kroah-Hartman has released seven new stable kernel versions, each containing a critical security patch for a vulnerability that has been lingering for years. The updates—spanning versions from the long-term stable 5.10 branch to the latest 7.0 series—address CVE-2026-46333, a flaw that was first identified by security firm Qualys and for which a fix was proposed as early as 2020 by researcher Jann Horn. With a proof-of-concept exploit now publicly available, the urgency to upgrade cannot be overstated.
The affected kernels are: 7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, 5.15.207, and 5.10.256. Users running any of these branches are strongly advised to update immediately. In addition to the CVE fix, some of these releases include patches for other bugs, making the upgrade doubly worthwhile.
What Is CVE-2026-46333?
While full technical details of the vulnerability remain limited to official advisories, what is known paints a troubling picture. The flaw was reported by the Qualys Security Advisory team, a group well known for discovering critical vulnerabilities in open-source software. Remarkably, a patch for the issue was proposed by Jann Horn (of Google Project Zero fame) back in 2020, but it took over six years for the fix to be incorporated into the stable kernel tree. The delay underscores the complex process of kernel maintenance, where patches must be carefully vetted and backported across multiple branches.
A proof-of-concept (PoC) exploit has already been published, meaning that attackers can now easily weaponize the vulnerability. Although the specific impact depends on the system configuration, such exploits typically allow for privilege escalation or denial-of-service attacks. Organizations handling sensitive data should treat this as a high-priority update.
Kernel Version Breakdown
The seven kernels released cover a broad spectrum of Linux environments, from enterprise servers running older long-term support (LTS) branches to cutting-edge desktop systems. Here’s a quick look at who should pay attention:
- 7.0.8 – The latest stable series, suitable for users who want the newest features but also the most recent security fixes.
- 6.18.31 – A mid-cycle stable release, often used in rolling distributions.
- 6.12.89 – Part of the 6.12 LTS branch, which is widely deployed in cloud and container environments.
- 6.6.139 – Another LTS variant, popular in embedded systems.
- 6.1.173 – A well-tested LTS kernel used by many enterprise distributions.
- 5.15.207 – A long-term supported kernel, still common in production.
- 5.10.256 – One of the oldest still-supported LTS kernels, critical for legacy systems.
Each of these versions now includes the patch for CVE-2026-46333, and some also contain additional bug fixes. The exact list of supplementary patches can be found in the respective changelogs.
The Backstory: A Vulnerability Reported Years Ago
It is unusual for a vulnerability to remain unpatched in the stable kernel for so long after a fix was proposed. According to public records, Jann Horn submitted a patch for CVE-2026-46333 in 2020, but it was never merged into the mainline at the time. The reasons for the delay are not fully clear, but may include concerns about the patch’s side effects, lack of a working exploit at the time, or simply oversight. With the recent publication of a PoC exploit, the pressure on maintainers increased dramatically, leading to the current batch of stable kernel updates.
This incident serves as a reminder that even well-known vulnerabilities can take years to be fully addressed. Users should not assume that a fix will appear automatically; proactive monitoring of security advisories is essential.
What Users Should Do
For most Linux users, the update process is straightforward. Running sudo apt update && sudo apt upgrade (on Debian/Ubuntu) or sudo dnf upgrade (on Fedora) will pull in the new kernel. However, because kernel updates require a reboot to take effect, administrators should plan for a maintenance window if possible. In virtualized environments, live patching solutions (like Ksplice or kpatch) may allow for zero-downtime updates, but they must be configured to include the specific CVE fix.
If your distribution does not yet offer the patched kernel, you can download the source directly from kernel.org and compile it manually, though this is not recommended for most users. The safest course is to update via the official package repositories.
Additional Considerations
Because some of these kernels contain extra patches beyond the CVE fix, upgrading also helps protect against other less publicized bugs. Furthermore, keeping your kernel up to date reduces the attack surface and ensures compliance with security best practices.
Conclusion
The release of seven stable kernel versions with patches for CVE-2026-46333 marks the end of a long wait for a fix. While the delay is concerning, the swift action once a PoC exploit emerged shows the kernel community’s responsiveness. Users should upgrade without delay to keep their systems secure.
For continuous coverage of Linux kernel security, stay tuned to official channels and trusted security feeds.