dmcdtc/openvz-cve-patch-2026GhostLock - CVE-2026-43499 backport patch for openVZ 7
CVE-2026-43499 backport patch for openVZ 7 kernel vzkernel-3.10.0-1160.129.1.ovz7.226.2
Since OpenVZ team didnt deploy patch for OpenVZ kernel (yet) with help of Claude i've created this one and it seems to work! (ive tested it on two servers in production, no problems so far)
USAGE:
git clone -b branch-rh7-3.10.0-1160.129.1.vz7.226.x-ovz --single-branch --depth 1 https://[email protected]/openvz/vzkernel.git
cd vzkernel
patch -p0 kernel/rtmutex.c < /patch/CVE-2026-43499-vzkernel3.10.patch (or just overwrite rtmutex.c from my attachments)
cp config.OpenVZ .config
make olddefconfig
make -j10 bzImage
make -j10 modules
make modules_install
cp arch/x86/boot/bzImage /boot/vmlinuz-3.10.0-1160.129.1.ovz7.226.2
dracut /boot/initramfs-3.10.0-1160.129.1.ovz7.226.2.img 3.10.0-1160.129.1.ovz7.226.2
grub2-mkconfig -o /boot/grub2/grub.cfg (or if EFI then EFI path)
Thats it .. make new kernel default and reboot into kernel best to do it on test env to see if it works
If anyone have better solution or if ive made some critical mistake i will be glad to hear and correct... perhaps i will make .rpm or some repo .. i am just lazy ATM, still waiting to see if OpenVZ team is going to do something officially before i do something on my own...
I have now added binary kernel for openvz with official 119 kernel patched .. you have .spec and patch in binary released.. best to recompile with original src.rpm from openVZ to be sure for security reasons
UPDATE 24-Jul_26
There is now an official patch you can check here
https://bitbucket.org/openvz/vzkernel/commits/branch/branch-rh7-3.10.0-1160.129.1.vz7.226.x-ovz updated
Binaries: https://download.openvz.org/virtuozzo/factory/x86_64/os/Packages/v/