Overview

• Article subtype: Security Fix Delivery.
• Purpose: Describes the delivery of ZSphere fixes for the CVE-2026-46333 / CVE-2026-43494 kernel vulnerabilities, including the remediation scope, upgrade requirements, and verification methods.
• Recommended action: If a security scan flags these vulnerabilities in a ZSphere 5.0.0 environment, consider upgrading to ZSphere 5.1.0. After the hosts restart into the new kernel, run the scan again to confirm remediation.

Release information

• Product: ZSphere.
• Component: ZSphere.
• Version: 5.1.0.
• Update/patch ID: ZSV-12648.
• Release date: August 5, 2026.
• Last updated: August 25, 2026.
• Status: Released.
• Delivery format: Full release / version update.

Applicability

• Applicable product/version: Upgrade from ZSphere 5.0.0 to 5.1.0.
• Applicable deployment: ZSphere 5.0.0 environments that use affected kernel versions.
• Prerequisites: The current environment is flagged for CVE-2026-46333 / CVE-2026-43494 by a security scan and requires a version upgrade or kernel update for remediation.
• Not applicable: No separate action is required for environments that are not flagged for the CVEs or whose running kernel version has been confirmed to be outside the affected range.

Update details

Security fix

• Related CVEs: CVE-2026-46333 and CVE-2026-43494.
• Fixed-version matrix: ZSphere 5.1.0 includes these security fixes.
• Installation requirements: Upgrade to 5.1.0 according to the official ZSphere release notes. If host kernel, driver, or installation ISO updates are involved, update the corresponding components and perform any required restart, reconnection, or rescan.
• Security note: This article describes only fix delivery information and does not provide vulnerability exploitation details.
• Remediation background: When a security scan reports CVE-2026-46333 or CVE-2026-43494 in a ZSphere 5.0.0 environment, the ZSphere host kernel must be updated. The customer kernel recorded in ZSV-12648 is 4.18.0-553.69.1.13.gc220c6303994.el8.x86_64.
• Fix details: Update the kernel and supporting drivers for the following operating systems, and update the kernel files in the ISOs used for installation and OS upgrades.

• Artifact update scope: rpm-repo-data must update the repository-resolvable kernel, kernel-tools, perf, bpftool, python3-perf, kmod driver packages, and manifest metadata. zstack-distro must update the vmlinuz, initrd.img, and squashfs.img required for ISO builds, along with the kmod driver packages in the h84r/el8 ISO repository.
• Upgrade note: Deployed ZSphere hosts do not automatically switch the running kernel when repository data or ISO build inputs change. Install the new kernel through the product upgrade process and schedule a maintenance-window restart. The vulnerability fix takes effect only after the host restarts into the new kernel; confirm the currently running kernel version before rescanning. Previously released ISOs are not automatically rewritten by this change. To include the new kernel artifacts, rebuild the ISO with zstack-distro after the changes are merged.

Update procedure

1. Obtain ZSphere 5.1.0 or a patch containing these security fixes through an official delivery channel.
2. Before the upgrade, consider contacting ZStack Technical Support to assess the current ZSphere version, host operating system, host count, business window, and rollback plan.
3. Complete the version upgrade according to the official ZSphere release notes and upgrade process.
4. If the update includes a host kernel or installation ISO update, update the applicable hosts, perform the required restart, and check their status as described in the release notes.
5. After the upgrade, check that the management services, hosts, virtual machines, storage, networks, and alarms are operating normally.

Verification

• Version verification: Confirm that the environment has been upgraded to ZSphere 5.1.0 or another version containing the CVE-2026-46333 / CVE-2026-43494 fixes.
• Kernel verification: On every upgraded host, confirm that the running kernel is within the fixed-version range listed in this article.
• Functional verification: Rerun the original security scan and confirm that the remediated environment is no longer flagged for the corresponding risks.
• Log/task verification: Check upgrade tasks, UI messages, host status, related logs, and alarm records, and confirm that no upgrade or kernel-loading exceptions occur.
• Test coverage note: ZSV-12648 records that the kernel version in the ISO was checked. Upgrade installation was not covered; complete an assessment according to the official release notes before upgrading.

Risks and rollback

• Business impact: The version upgrade and host kernel update might involve management service restarts, host restarts, or virtual machine migration. Assess the maintenance window according to the official upgrade process.
• Compatibility risks: Upgrading only some components, not restarting hosts, or not confirming the running kernel before rescanning might leave the remediation incomplete.
• Rollback: Follow the upgrade and rollback procedures in the official ZSphere release notes.
• Precautions: For scenarios involving multiple hosts, storage, networks, dual management nodes, host kernels, or security fixes, consider completing backups and preparing a migration plan and rollback measures before the operation.

Related information

• Related CVEs/security advisories: CVE-2026-46333 and CVE-2026-43494.
• Internal tracking: ZSV-12648.

Change log

• August 25, 2026: Added delivery information for the ZSphere 5.0.0-to-5.1.0 kernel vulnerability remediation based on ZSV-12648.