Two Linux Bugs, One Scary Number, and Which One Is Actually Rooting Servers
This week produced two separate Linux kernel stories that are very easy to mash into one, and the triage note that landed on my desk did exactly that. They are not the same bug, they do not carry the same urgency, and treating them as one leads you to patch the wrong thing first. Let me pull them apart.
The one with the frightening CVSS
CVE-2026-98432 is a use-after-free in the kernel's IPv4 TCP connection setup — a race during the handshake where the kernel hands IP options to a new socket without copying them, then can read that memory after it's freed. The kernel's own CVE team scored it 9.8. The Hacker News has the full breakdown, including the detail the headline leaves out: Anthropic's model wrote a working root exploit, but that exploit targeted servers running a multipath TCP (MPTCP) listener.
That qualifier matters enormously for anyone running mail. On Linux, an application has to explicitly ask for MPTCP when it opens a socket. Postfix and Dovecot do not. So the demonstrated remote-root path does not describe a stock iRedMail box out of the gate. Red Hat's position is that a remote attacker reaching an exposed TCP service could trigger the race for a crash, and scores it lower (5.9 on the CVE page, 8.1 in the machine-readable file — their own numbers disagree). Whether a server without an MPTCP listener can be rooted the same way is, per Anthropic's post, simply not stated. IPv6 connections are not affected because the kernel copies the options there.
The practical catch: as of October 29, Ubuntu and RHEL had not shipped a fixed kernel. Debian, Oracle Linux, SUSE and Amazon Linux had, at least for some kernels. If you build your own, the fix landed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. And crucially — this CVE is not in CISA's KEV catalog and no one has reported it exploited. It's a serious bug to patch when your vendor ships the kernel. It is not a fire.
The one actually rooting boxes
The fire is the other story. CISA added two vulnerabilities to KEV on October 28 on evidence of active exploitation: a VMware ESX logging flaw (CVE-2026-41709) and Fragnesia, the Linux kernel LPE CVE-2026-46300. Per Help Net Security's reporting, Fragnesia is being chained with the PHP2Shell flaws (CVE-2026-109618/109619) to plant webshells and run commands as root — a campaign that reportedly rooted 25 servers across the US, Japan, Taiwan and South Korea. BleepingComputer also covered the CISA warning.
Fragnesia on its own is a local privilege escalation — it needs a foothold first. That's exactly what PHP2Shell provides against exposed PHP management interfaces. The chain is the threat, not either half alone. CISA's federal deadline for Fragnesia was October 31; the ESX one, November 11.
What I'd do Monday
Patch Fragnesia and audit for PHP2Shell first — that's the one with exploitation evidence and an attack chain that ends at root. If you run a Linux kernel that predates your distro's Fragnesia fix and you expose any PHP app, assume you're in scope and check for webshells. The VMware ESX flaw matters if you run vCenter environments, less so for a bare mail host.
For the 9.8 TCP flaw: note it, confirm which kernel you're running, and install the fixed kernel when Ubuntu or RHEL ships it. Don't let the number stampede you into deferring the bug that's actually being used.
Sources
Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
More about the author →Was this article helpful?
Tap a star — no sign-in needed.
Be the first to rate this article.
Related guides
Three names on the KEV list, and why the kernel one is the one to chase
Two big enforcement stories broke on the same day, and both are worth reading, but neither is the thing that should change what you do this week. Help Net Security reported that the DOJ and FBI seized the infrastructure behind QScan and QTRouter , a pair of tools a Nanjing-linked outfit called QTFY used to build an obfuscation network out of hijacked IoT devices — the kind of story where NASA, the Federal Reserve and the U.S. Senate turn up on the victim list. Separately, Australian police, working with the FBI, arrested two men alleged to be part of TeamPCP , the crew that cloned the Shai-Hulud worm and poisoned open-source packages to harvest credentials at scale.
The Brotli RCE is an HTTP problem, not a TLS one
A memory-corruption bug in Google's Brotli decoder, CVE-2026-111497, got the scary framing it deserves — The Hacker News leads with the Node.js RCE and the long tail of affected software, and the oss-security list carried the coordination thread. Before you start grepping your mail stack in a panic, though, let me narrow the blast radius, because the triage instinct ("Brotli is in TLS, so my mail TLS is exposed") is wrong.
A Gitea Code-Injection Bug Is Being Exploited — Patch, Then Assume the Worst
CISA added CVE-2026-60004 , described as a Gitea code injection vulnerability, to its Known Exploited Vulnerabilities catalog on 25 August 2026. The KEV listing is the important part: CISA doesn't add things to that catalog on theory. It adds them when there's evidence of active exploitation in the wild. So this isn't "a bug was disclosed" — it's "somebody is using this against real servers right now."
OVSwrap (CVE-2026-64531): a local-root kernel bug hiding in a very large patch wave
On 21 August 2026 Canonical pushed out a broad set of kernel security notices, and threaded through most of them is one identifier: CVE-2026-64531 , nicknamed OVSwrap , an Open vSwitch flaw in the Linux kernel that leads to local root. The oss-security post that carries the name declines AI crawlers , so I only have its subject line to confirm the classification — Linux kernel / OVS, local privilege escalation. The details of the write-up I can't quote, and won't guess at.