[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgciITq9C-ZevOeRp214z7AKc4mDOreGDbUrt3KoU8lY":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"cfc5f8b2-4f67-4f87-9900-1812b71dbac0","Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes","attackers-started-scanning-in-the-wild-for-linux-kernel-rce-flaw-ubuntu-releases-79226b","Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for […] The post Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes appeared first on Cyber Security News.","A critical Linux kernel vulnerability, CVE-2026-98432, allowing remote command execution as root, is being actively scanned for in the wild. Ubuntu has released early fixes in its -proposed pocket for several LTS releases, though patches are still in testing. The flaw, a use-after-free bug in IPv4 TCP connection setup, affects kernel versions 4.4 and later, with researchers noting potential exploit development using AI models.","Attackers are scanning for Linux kernel RCE flaw CVE-2026-98432; Ubuntu releases early fixes.","https:\u002F\u002Fcybersecuritynews.com\u002Flinux-kernel-rce-flaw-ubuntu-fixes\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FLinux-Kernel-RCE-Flaw-Ubuntu-Fixes.webp","2026-11-03T08:58:05+00:00","2026-11-03T09:01:18.635854+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Linux Kernel","product",{"name":21,"type":22},"Ubuntu","vendor",{"name":24,"type":22},"Canonical",{"name":26,"type":19},"Claude",{"name":28,"type":22},"Anthropic","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-98432","Linux kernel RCE flaw",[21,24,28],{"controls":54,"vendors":141},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":46,"name":114,"problem":115,"products":116},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"active-scanning-targets-critical-linux-kernel-rce-flaw-before-patches-stabilize","Active Scanning Targets Critical Linux Kernel RCE Flaw Before Patches Stabilize","A use-after-free bug in the Linux kernel's IPv4 TCP connection handling (CVE-2026-98432) allows unauthenticated remote attackers to execute commands as root, affecting kernel versions 4.4 and later — a massive portion of production Linux infrastructure worldwide. The danger is compounded by the fact that Ubuntu's fixes are only available in a testing ('proposed') pocket, meaning most organizations cannot yet apply a stable, vendor-supported patch. Active scanning in the wild signals that threat actors are racing to develop working exploits, potentially accelerated by AI-assisted reverse engineering. This incident highlights the critical window of exposure that exists between vulnerability disclosure and stable patch availability, and why compensating controls must be ready to deploy immediately.",[147,148,149,150,151,152,153],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 13: Network Monitoring and Defense","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":155,"NIST SP 800-53 SI-2: Flaw Remediation":156,"CIS Control 13: Network Monitoring and Defense":157,"OWASP A06:2021 Vulnerable and Outdated Components":158,"CIS Control 7: Continuous Vulnerability Management":159,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"NIS2 requires essential entities to have incident handling and vulnerability disclosure processes in place; the active exploitation scanning of a critical RCE flaw triggers obligations to act and report under this article.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes — a formal remediation SLA would drive urgent action even when only pre-release patches are available.","Detecting the in-the-wild scanning activity depends on robust network monitoring; this control requires continuous monitoring of network traffic to identify attack patterns like those targeting CVE-2026-98432.","The Linux kernel is a foundational component; A06 directly applies because exploiting a known, unpatched vulnerability in a core system component is exactly the risk this category addresses.","Active scanning began before stable patches existed; a continuous vulnerability management program would have ensured compensating controls were applied immediately upon CVE disclosure rather than waiting for a polished fix.","This control requires timely identification and remediation of technical vulnerabilities; it would mandate a documented response plan for critical kernel flaws actively being scanned in the wild.","Because this vulnerability allows root-level command execution without authentication, enforcing strict network access controls and limiting which systems are reachable externally would directly reduce the attack surface exploitable via this flaw."]