As of time of writing this OpenVZ havent yet published a patch for this very serious flaw in kernel. With help of Claude i have backported patch from newer kernel to 3.10 and it seems to work. Feedback and testing is appreciated.
You have two options, either download latest kernel source from OpenVZ’s bitbucket repo or build latest offical kernel 3.10.0-1160.119.1.vz7.224.4 and apply the patch. Ive put all files on my github page where you have .spec and patch but also binary .rpm’s if you feel brave enough to try. I recommend doing .src.rpm recompile again with my kernel.spec and patch so you would be sure no other files were modified.
How to manually recompile latest kernel from bitbucket (3.10.0-1160.129.1.vz7.226.2)
USAGE:git clone -b branch-rh7-3.10.0-1160.129.1.vz7.226.x-ovz --single-branch --depth 1 https://USERNAME@bitbucket.org/openvz/vzkernel.gitcd vzkernel
patch -p0 kernel/rtmutex.c < /patch/CVE-2026-43499-vzkernel3.10.patch (or just overwrite rtmutex.c from my attachments)
cp config.OpenVZ .config
make olddefconfig
make -j10 bzImage
make -j10 modules
make modules_install
cp arch/x86/boot/bzImage /boot/vmlinuz-3.10.0-1160.129.1.ovz7.226.2
dracut /boot/initramfs-3.10.0-1160.129.1.ovz7.226.2.img 3.10.0-1160.129.1.ovz7.226.2
grub2-mkconfig -o /boot/grub2/grub.cfg
If you prefer to recompile it using src.rpm grab .spec file and patch from my github repo release page
https://github.com/dmcdtc/openvz-cve-patch-2026/releases/tag/openvz-ghostlock-binary
Main page is at:
https://github.com/dmcdtc/openvz-cve-patch-2026
Link to official latest openVZ src.rpm for vzkernel (to which you apply patch and use my .spec)
Contact me for any feedback or help
Leave a Reply