CISA warns of Fragnesia Linux kernel flaw exploited with PHP2Shell
- Status
- Confirmed
- Kind
- Vulnerability
- Vendor
- Linux
- Product
- Linux kernel
- First seen
- Confirmed
Summary
CISA has told federal agencies to patch a high-severity Linux kernel privilege escalation bug, according to BleepingComputer. The item says attackers are chaining it with PHP2Shell flaws in the wild.
If you use Linux
Apply the Linux kernel patch from your distribution or vendor now
Patch the PHP components affected by PHP2Shell
Check hosts for signs of unexpected privilege escalation
Check whether your distribution has published a patched kernel for CVE-2026-98432 and install it
Reboot affected servers after the kernel update so the fix takes effect
Restrict network exposure of unpatched Linux servers until they are updated
What the sources say 19
· BleepingComputer: “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.” Source
· BleepingComputer on Bluesky: “CISA ordered US federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.” Source
· The Hacker News: “A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions.” Source
· Mastodon: “CVE-2026-98432 reportedly turns a Linux TCP use-after-free into a remote kernel compromise.” Source
· Mastodon: “Linux kernel TCP vulnerability CVE-2026-98432 sparks CVSS dispute: 9.8 vs 5.9.” Source
· r/sysadmin: “CVE-2026-98432: Linux remote root via multipath TCP listener” Source
· Bluesky: “⚠️ Sonassi is reporting an Incident since 07:50 UTC” Source
· Mastodon: “A # critical use-after-free # vulnerability has been identified in the Linux kernel’s IPv4 # TCP implementation.” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before ca...” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlis...” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION smb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION, that is the whole of FILE_SYS...” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flower: validate mask pointer after nla_next()” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl()” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs” Source
· Mastodon: “In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain” Source