Two kernel advisories came out on 27 Oct. I checked them against NS8 nodes running Rocky Linux 9 with kernel 5.14.0-687.59.1.el9_8.
CVEs
- WID-SEC-2026-2640 (BSI, rated critical): CVE-2026-64561 to CVE-2026-64565.
- 64561, 64563 and 64564 are already fixed in 687.59.1.
- 64565 does not affect the EL9 kernel.
- 64562 is still open. It is a KVM bug with nested virtualization, and Red Hat has no fix yet.
- WID-SEC-2025-0453, update for RHSA-2026:90365: the new kernel 687.61.1 fixes CVE-2024-57974, a local denial of service (crash).
Exploitability
- All of these are local only (AV:L). An attacker must already be able to run code on the node. They cannot be exploited from the network or the LAN.
- CVE-2026-64562 only matters if the node itself runs KVM guests with nested virtualization. A typical NS8 node does not, it runs containers only
Mitigation
- Install 5.14.0-687.61.1 as soon as Rocky publishes it (dnf upgrade ‘kernel*’),
- Until Red Hat fixes CVE-2026-64562: if you run KVM guests on an NS8 node, check cat /sys/module/kvm_intel/parameters/nested (or kvm_amd). If you do not need nested virtualization, disable it.
- Otherwise no action is needed. The critical rating comes from the CVSS score, but in practice the risk on an NS8 node is low.