
Linux 内核升级指南 - 修复 CVE-2026-64561
声明: 本文仅记录本人服务器环境下的修复过程,并非安全专业分析。如有不当之处,欢迎指正。
本文档提供两种方式将 Linux Kernel 升级,用于修复 CVE-2026-64561:ELRepo RPM 安装(推荐)和源码编译。
| 项目 | 说明 |
|---|---|
| CVE 编号 | CVE-2026-64561 |
| 漏洞组件 | Linux Kernel KVM/x86 |
| 修复方式 | 升级 Linux Kernel(ELRepo RPM 或源码编译) |
本教程提供两种升级方式,可根据环境选择:
适用于能正常访问 ELRepo 仓库的环境,无需编译,操作简单。
方法一原文参考: 魔方云商家可将CentOS系宿主机内核升级至7.1.6以避免CVE-2026-64561漏洞(作者:欢-Huan)
系统环境:
| 项目 | 信息 |
|---|---|
| 操作系统 | CentOS Stream 8 |
| 原始内核 | 4.18.0-552.el8.x86_64 |
| 目标内核 | 7.1.6-1.el8.elrepo.x86_64 |
| 内核来源 | ELRepo kernel-ml |
硬件环境(本文作者环境,仅供参考):
| 项目 | 信息 |
|---|---|
| CPU | AMD Ryzen 9 9950X |
| 用途 | KVM / LXD 宿主机 |
| 网卡 | Realtek r8126(第三方驱动) |
注意: 此为微星主板的网卡驱动,如无需特别驱动即可正常通网的机器无需这步。对应的网卡请找对应的驱动,不是每个人的驱动都是一样的。
查看当前环境:
cat /etc/os-release
uname -r
升级路线:
4.18.0-552.el8
↓
7.1.6-1.el8.elrepo
如果系统已经安装 ELRepo,可以跳过。
# 导入 ELRepo GPG 密钥
rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# 安装 ELRepo 仓库
dnf install -y https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
检查:
# 检查 ELRepo 仓库是否已添加
dnf repolist | grep elrepo
# 查看可用的 kernel-ml 版本列表
dnf --enablerepo=elrepo-kernel list kernel-ml --showduplicates
确认存在:
kernel-ml.x86_64 7.1.6-1.el8.elrepo
# 安装内核本体、核心和模块
dnf --enablerepo=elrepo-kernel install -y \
kernel-ml-7.1.6-1.el8.elrepo.x86_64 \
kernel-ml-core-7.1.6-1.el8.elrepo.x86_64 \
kernel-ml-modules-7.1.6-1.el8.elrepo.x86_64
编译第三方驱动(如需要):
# 安装内核开发包用于编译第三方驱动
dnf --enablerepo=elrepo-kernel install -y \
kernel-ml-devel-7.1.6-1.el8.elrepo.x86_64
# 查看已安装的 kernel-ml 包
rpm -qa | grep kernel-ml
查看 grub:
# 查看 grub 中的内核列表
grubby --info=ALL | grep title
# 查看所有可用内核
grubby --info=ALL | grep kernel
设置:
# 设置默认启动内核
grubby --set-default /boot/vmlinuz-7.1.6-1.el8.elrepo.x86_64
确认:
# 验证默认内核
grubby --default-kernel
# 检查 grub 环境保存状态
grub2-editenv list
# 重启服务器
reboot
检查:
# 查看当前内核版本
uname -r
预期输出:
7.1.6-1.el8.elrepo.x86_64
注意: 此为微星主板的网卡驱动,如无需特别驱动即可正常通网的机器无需这步。对应的网卡请找对应的驱动,不是每个人的驱动都是一样的。
# 查看 r8126 驱动版本信息
modinfo r8126 | grep vermagic
如果不是:
7.1.6-1.el8.elrepo.x86_64
需要重新编译。
注意: 此为微星主板的网卡驱动,如无需特别驱动即可正常通网的机器无需这步。对应的网卡请找对应的驱动,不是每个人的驱动都是一样的。
# 进入驱动源码目录
cd /root/qudong_backup/r8126-10.016.00
# 清理旧编译产物
make clean
# 编译驱动
make
# 安装驱动
make install
# 重新生成模块依赖
depmod -a
# 加载驱动
modprobe r8126
检查:
# 确认驱动已加载
lsmod | grep r8126
7.1.x 内核包含新版 KVM/MMU:
CONFIG_KVM_GUEST_MEMFD=y
CONFIG_KVM_GENERIC_MMU_NOTIFIER=y
CONFIG_KVM_MM_U_LOCKLESS_AGING=y
CONFIG_KVM_EXTERNAL_WRITE_TRACKING=y
CONFIG_KVM_MAX_NR_VCPUS=4096
# 查看所有可用内核
grubby --info=ALL | grep kernel
恢复旧内核:
# 设置旧内核为默认启动项
grubby --set-default /boot/vmlinuz-4.18.0-552.el8.x86_64
升级路径:
CentOS Stream 8
↓
Linux 4.18
↓
ELRepo kernel-ml 7.1.6
结果:
✅ 升级到 Linux 7.1.6
✅ KVM/MMU 子系统更新
✅ 支持更多新硬件
✅ 保留旧内核回滚能力
注意:
适用于无法访问 ELRepo 仓库,或需要使用 kernel.org 官方 stable 版本的环境。具体步骤见下方。
查看当前环境:
cat /etc/os-release
uname -r
由于本人服务器环境中:
因此采用:
kernel.org 官方 stable 源码编译方式升级内核。
说明:
该方案仅为本人服务器环境下的解决方法,不代表所有环境必须使用源码编译。
# 进入源码目录
cd /usr/src
# 下载 Linux 7.1.7 源码
wget https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.7.tar.xz
# 解压源码
tar -xf linux-7.1.7.tar.xz
# 进入源码目录
cd /usr/src/linux-7.1.7
# 确认源码完整
ls Makefile
预期输出:
Makefile
由于源码编译安装的 7.1.3 内核未生成:
/boot/config-7.1.3
因此使用之前编译时保存的配置:
# 检查旧配置是否存在
ls -lh /usr/src/linux-7.1.3/.config
确认存在:
/usr/src/linux-7.1.3/.config
# 复制旧配置到新内核目录
cp /usr/src/linux-7.1.3/.config /usr/src/linux-7.1.7/.config
# 进入新内核源码目录
cd /usr/src/linux-7.1.7
# 基于旧配置生成新配置
make olddefconfig
预期输出:
#
# configuration written to .config
#
# 检查 KVM 相关配置项
grep -E "CONFIG_KVM|CONFIG_KVM_INTEL" .config
预期输出:
CONFIG_KVM_X86=m
CONFIG_KVM=m
CONFIG_KVM_INTEL=m
说明:
满足当前 KVM Intel 环境要求。
# 查看 CPU 核心数
nproc
# 使用全部 CPU 编译(根据实际核心数调整)
make -j$(nproc)
# 编译完成后验证内核镜像
ls -lh arch/x86/boot/bzImage
预期输出:
-rw-r--r-- 1 root root xxM arch/x86/boot/bzImage
表示内核镜像生成成功。
# 安装内核模块
make modules_install
# 验证模块安装
ls /lib/modules/
预期输出:
7.1.7
# 检查 KVM 模块
find /lib/modules/7.1.7 -name "kvm*"
预期输出:
/lib/modules/7.1.7/kernel/arch/x86/kvm/kvm.ko
/lib/modules/7.1.7/kernel/arch/x86/kvm/kvm-intel.ko
/lib/modules/7.1.7/kernel/arch/x86/kvm/kvm-amd.ko
确认:
# 安装内核
make install
# 检查安装结果
ls -lh /boot | grep 7.1.7
预期输出:
initramfs-7.1.7.img
System.map-7.1.7
vmlinuz-7.1.7
# 生成 GRUB 配置
grub2-mkconfig -o /boot/grub2/grub.cfg
# 设置默认启动内核
grubby --set-default /boot/vmlinuz-7.1.7
# 验证默认内核
grubby --default-kernel
预期输出:
/boot/vmlinuz-7.1.7
# 重启服务器
reboot
# 查看当前内核版本
uname -r
预期输出:
7.1.7
✅ 已运行 Linux 7.1.7
# 查看 KVM 模块
lsmod | grep kvm
预期输出:
kvm_intel
kvm
irqbypass
✅ KVM Intel 正常加载
# 查看 KVM 模块来源
modinfo kvm_intel | grep filename
预期输出:
filename: /lib/modules/7.1.7/kernel/arch/x86/kvm/kvm-intel.ko
✅ 当前使用的是 7.1.7 编译生成的 KVM Intel 模块
重要: 旧内核不应立即删除。
# 列出可用内核
grubby --info=ALL | grep kernel
如果新内核有问题,设置旧内核:
# 设置旧内核为默认启动项
grubby --set-default /boot/vmlinuz-7.1.3
# 重启生效
reboot
| 项目 | 修复前 |
|---|
最终运行:
CentOS Stream 8
x86_64
Kernel:
7.1.7
KVM:
kvm_intel
kvm
irqbypass
修复完成。
暂时保留:
7.1.3
6.18.8-1.el8.elrepo.x86_64
4.18.x
用于异常情况下回滚。
# 查看可用内核
grubby --info=ALL | grep kernel
以后继续升级时建议保存:
# 保存当前内核配置
cp /usr/src/linux-7.1.7/.config /boot/config-7.1.7
后续升级:
# 复制配置到新内核目录
cp /boot/config-7.1.7 新内核源码目录/.config
即可继续复用配置。
Disclaimer: This repository only documents my personal fix process on a specific server environment. It is not a professional security analysis. Corrections are welcome.
This guide provides two methods to upgrade Linux Kernel for fixing CVE-2026-64561: ELRepo RPM installation (recommended) and building from source.
| Item | Description |
|---|---|
| CVE ID | CVE-2026-64561 |
| Affected Component | Linux Kernel KVM/x86 |
| Fix Method | Upgrade Linux Kernel (ELRepo RPM or build from source) |
This guide provides two upgrade methods. Choose based on your environment:
For environments with reliable access to the ELRepo repository. No compilation required.
Method A Reference: 魔方云商家可将CentOS系宿主机内核升级至7.1.6以避免CVE-2026-64561漏洞(Author: 欢-Huan)
System environment:
| Item | Information |
|---|---|
| OS | CentOS Stream 8 |
| Original Kernel | 4.18.0-552.el8.x86_64 |
| Target Kernel | 7.1.6-1.el8.elrepo.x86_64 |
| Kernel Source | ELRepo kernel-ml |
Hardware environment (author's setup, for reference only):
| Item | Information |
|---|---|
| CPU | AMD Ryzen 9 9950X |
| Purpose | KVM / LXD Host |
| NIC | Realtek r8126 (third-party driver) |
Note: This is a MSI motherboard NIC driver. Machines that can connect to the network without special drivers do not need this step. Please find the corresponding driver for your NIC.
Upgrade path:
4.18.0-552.el8
↓
7.1.6-1.el8.elrepo
If ELRepo is already installed, skip this step.
# Import ELRepo GPG key
rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# Install ELRepo repository
dnf install -y https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
Check:
# Check if ELRepo repository is added
dnf repolist | grep elrepo
# List available kernel-ml versions
dnf --enablerepo=elrepo-kernel list kernel-ml --showduplicates
Confirm exists:
kernel-ml.x86_64 7.1.6-1.el8.elrepo
# Install kernel body, core, and modules
dnf --enablerepo=elrepo-kernel install -y \
kernel-ml-7.1.6-1.el8.elrepo.x86_64 \
kernel-ml-core-7.1.6-1.el8.elrepo.x86_64 \
kernel-ml-modules-7.1.6-1.el8.elrepo.x86_64
Compile third-party drivers (if needed):
# Install kernel development package for third-party drivers
dnf --enablerepo=elrepo-kernel install -y \
kernel-ml-devel-7.1.6-1.el8.elrepo.x86_64
# View installed kernel-ml packages
rpm -qa | grep kernel-ml
Check grub:
# View kernel list in grub
grubby --info=ALL | grep title
# View all available kernels
grubby --info=ALL | grep kernel
Set:
# Set default boot kernel
grubby --set-default /boot/vmlinuz-7.1.6-1.el8.elrepo.x86_64
Confirm:
# Verify default kernel
grubby --default-kernel
# Check grub environment save status
grub2-editenv list
# Reboot server
reboot
Check:
# Check current kernel version
uname -r
Expected output:
7.1.6-1.el8.elrepo.x86_64
Note: This is a MSI motherboard NIC driver. Machines that can connect to the network without special drivers do not need this step. Please find the corresponding driver for your NIC.
# View r8126 driver version info
modinfo r8126 | grep vermagic
If not:
7.1.6-1.el8.elrepo.x86_64
Recompilation is required.
Note: This is a MSI motherboard NIC driver. Machines that can connect to the network without special drivers do not need this step. Please find the corresponding driver for your NIC.
# Enter driver source directory
cd /root/qudong_backup/r8126-10.016.00
# Clean old build artifacts
make clean
# Compile driver
make
# Install driver
make install
# Regenerate module dependencies
depmod -a
# Load driver
modprobe r8126
Check:
# Confirm driver is loaded
lsmod | grep r8126
7.1.x kernel includes new KVM/MMU:
CONFIG_KVM_GUEST_MEMFD=y
CONFIG_KVM_GENERIC_MMU_NOTIFIER=y
CONFIG_KVM_MM_U_LOCKLESS_AGING=y
CONFIG_KVM_EXTERNAL_WRITE_TRACKING=y
CONFIG_KVM_MAX_NR_VCPUS=4096
# View all available kernels
grubby --info=ALL | grep kernel
Restore old kernel:
# Set old kernel as default boot entry
grubby --set-default /boot/vmlinuz-4.18.0-552.el8.x86_64
Upgrade path:
CentOS Stream 8
↓
Linux 4.18
↓
ELRepo kernel-ml 7.1.6
Result:
✅ Upgraded to Linux 7.1.6
✅ KVM/MMU subsystem updated
✅ Better new hardware support
✅ Old kernel rollback capability retained
Notes:
For environments without ELRepo access, or when the official kernel.org stable release is required. See detailed steps below.
Check current environment:
cat /etc/os-release
uname -r
In my environment:
Therefore:
I used the official kernel.org stable source code and built Kernel 7.1.7 manually.
Note:
This is my own environment solution, not a mandatory upgrade method for all systems.
# Enter source directory
cd /usr/src
# Download Linux 7.1.7 source
wget https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.7.tar.xz
# Extract source
tar -xf linux-7.1.7.tar.xz
# Enter source directory
cd /usr/src/linux-7.1.7
# Verify source integrity
ls Makefile
Expected output:
Makefile
Since the source-compiled 7.1.3 kernel did not generate:
/boot/config-7.1.3
Use the configuration saved from previous compilation:
# Check if old config exists
ls -lh /usr/src/linux-7.1.3/.config
Confirmed to exist:
/usr/src/linux-7.1.3/.config
# Copy old config to new kernel directory
cp /usr/src/linux-7.1.3/.config /usr/src/linux-7.1.7/.config
# Enter new kernel source directory
cd /usr/src/linux-7.1.7
# Generate new config based on old config
make olddefconfig
Expected output:
#
# configuration written to .config
#
# Check KVM related config items
grep -E "CONFIG_KVM|CONFIG_KVM_INTEL" .config
Expected output:
CONFIG_KVM_X86=m
CONFIG_KVM=m
CONFIG_KVM_INTEL=m
Explanation:
Meets current KVM Intel environment requirements.
# Check CPU core count
nproc
# Compile using all CPUs (adjust based on your core count)
make -j$(nproc)
# Verify kernel image after compilation
ls -lh arch/x86/boot/bzImage
Expected output:
-rw-r--r-- 1 root root xxM arch/x86/boot/bzImage
Indicates kernel image generated successfully.
# Install kernel modules
make modules_install
# Verify module installation
ls /lib/modules/
Expected output:
7.1.7
# Check KVM modules
find /lib/modules/7.1.7 -name "kvm*"
Expected output:
/lib/modules/7.1.7/kernel/arch/x86/kvm/kvm.ko
/lib/modules/7.1.7/kernel/arch/x86/kvm/kvm-intel.ko
/lib/modules/7.1.7/kernel/arch/x86/kvm/kvm-amd.ko
Confirmed:
# Install kernel
make install
# Check installation result
ls -lh /boot | grep 7.1.7
Expected output:
initramfs-7.1.7.img
System.map-7.1.7
vmlinuz-7.1.7
# Generate GRUB configuration
grub2-mkconfig -o /boot/grub2/grub.cfg
# Set default boot kernel
grubby --set-default /boot/vmlinuz-7.1.7
# Verify default kernel
grubby --default-kernel
Expected output:
/boot/vmlinuz-7.1.7
# Reboot server
reboot
# Check current kernel version
uname -r
Expected output:
7.1.7
✅ Running Linux 7.1.7
# Check KVM modules
lsmod | grep kvm
Expected output:
kvm_intel
kvm
irqbypass
✅ KVM Intel loaded normally
# Check KVM module source
modinfo kvm_intel | grep filename
Expected output:
filename: /lib/modules/7.1.7/kernel/arch/x86/kvm/kvm-intel.ko
✅ Using KVM Intel module compiled with 7.1.7
Important: Old kernels should not be removed immediately.
# List available kernels
grubby --info=ALL | grep kernel
If the new kernel has issues, set old kernel:
# Set old kernel as default boot entry
grubby --set-default /boot/vmlinuz-7.1.3
# Reboot to apply
reboot
Final running state:
CentOS Stream 8
x86_64
Kernel:
7.1.7
KVM:
kvm_intel
kvm
irqbypass
Fix complete.
Temporarily keep:
7.1.3
6.18.8-1.el8.elrepo.x86_64
4.18.x
For rollback in case of issues.
# View available kernels
grubby --info=ALL | grep kernel
For future upgrades, recommend saving:
# Save current kernel config
cp /usr/src/linux-7.1.7/.config /boot/config-7.1.7
For subsequent upgrades:
# Copy config to new kernel directory
cp /boot/config-7.1.7 /new-kernel-source-directory/.config
This allows continued reuse of the configuration.
| 项目 | 信息 |
|---|
| 系统 | CentOS Stream 8 |
| 架构 | x86_64 |
| 虚拟化 | KVM Intel |
| 原始内核 | 6.18.8-1.el8.elrepo.x86_64 |
| 已运行内核 | 7.1.3 |
| 最终内核 | 7.1.7 |
| 修复后 |
|---|
| Linux Kernel | 7.1.3 | 7.1.7 |
| KVM Intel 模块 | 7.1.3 | 7.1.7 |
| CVE-2026-64561 | 存在风险 | 已通过升级内核修复 |
| KVM 功能 | 正常 | 正常 |
| Item | Information |
|---|
| OS | CentOS Stream 8 |
| Architecture | x86_64 |
| Virtualization | KVM Intel |
| Original Kernel | 6.18.8-1.el8.elrepo.x86_64 |
| Running Kernel | 7.1.3 |
| Final Kernel | 7.1.7 |
| Item | Before Fix | After Fix |
|---|
| Linux Kernel | 7.1.3 | 7.1.7 |
| KVM Intel Module | 7.1.3 | 7.1.7 |
| CVE-2026-64561 | Risk exists | Fixed via kernel upgrade |
| KVM Functionality | Normal | Normal |