Linux patch status tracker: which distros have fixed CVE-2026-98432 and PHP2Shell

Last checked: 4 November 2026, 09:30 UTC. For high-profile vulnerabilities, this page tracks whether each major Linux distribution has shipped a fix, and which package and advisory carry it. Every row links to the distribution's own security tracker or advisory, which remains the authority. The changelog at the bottom records every update.

Tracked now: CVE-2026-98432 · CVE-2026-109618, CVE-2026-109619

What the statuses mean

• Fixed Fixed package released by the distribution
• Fixed (by version) Shipped version is at or above the upstream fix, but the distribution has not recorded the CVE
• Fix pending Fix built and named by the distribution, not yet released
• Vulnerable Affected, no fixed package released
• No fix planned Affected, distribution says no fix is planned
• Not affected Distribution says this release is not affected

CVE-2026-98432: Linux kernel IPv4 TCP use-after-free

A use-after-free in the IPv4 TCP handshake path (tcp_v4_reqsk_destructor and inet_sock_destruct freed IP options with kfree() instead of kfree_rcu()). Present since Linux 4.4. IPv6 is not affected by the main issue.

Published: 15 Oct 2026 · Severity: Linux kernel CNA: CVSS 9.8; Red Hat: Critical, CVSS 9.8; Ubuntu: Critical; SUSE: Important, CVSS 8.1; Amazon Linux: CVSS 8.1; Oracle: Important
Exploitation: Not in the CISA KEV catalog (catalog version 2026.11.03).

Where releases stand: 15 fixed · 2 fixed (by version) · 4 fix pending · 4 vulnerable.

Primary sources: CVE record (kernel CNA) · Debian tracker (full fix description)

Upstream fixed versions

Source: CVE record, affected versions.

Distribution status

Our reporting: read the story.

CVE-2026-109618, CVE-2026-109619: PHP2Shell: two PHP remote code execution flaws

Two critical RCE flaws in the PHP runtime (GHSA-w8hw-w9fx-j79w, "RCE via OOM corruption"; GHSA-6wmf-4rv5-p3rp, "RCE via stale global state"). Every supported PHP branch is affected. Disabling session.upload_progress is not a fix.

Published: 21 Oct 2026 · Severity: PHP project (GitHub advisory): Critical; NVD: CVSS 9.8; Ubuntu: Critical; Red Hat: Important, CVSS 8.1; Amazon Linux: CVSS 8.1
Exploitation: Both CVEs were added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-26, with a federal remediation due date of 2026-10-29.

Where releases stand: 22 fixed · 2 no fix planned.

Primary sources: PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618) · PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) · PHP 8 changelog · CISA KEV entry

Upstream fixed versions

Source: PHP GitHub advisories.

Distribution status

Our reporting: read the story.

How we check

Statuses come only from each distribution's own data: the Ubuntu CVE tracker, the Debian security tracker, Red Hat's security data API, SUSE's CVE pages, the Amazon Linux security center, Alpine's secdb and package index, AlmaLinux's errata feed and Oracle's CVE repository. Where a distribution ships an upstream version at or above the fix but has not recorded the CVE, we mark it Fixed (by version) and say so. We list the main supported releases, not every service pack or add-on channel; follow the linked tracker for those. A fixed package only protects a system after it is installed and, for kernels, after a reboot into the new kernel.

You may reuse this data under CC BY 4.0 with a link to this page. Spot an error? Email editor@kernelpost.com and we will correct it and log the change below.

Cite this page

KernelPost. "Linux patch status tracker." Last checked 4 November 2026. https://kernelpost.com/linux-patch-status/
Link to a single row with its anchor, for example https://kernelpost.com/linux-patch-status/#cve-2026-98432-rhel-9.

Changelog

• 4 Nov 2026: Tracker launched with CVE-2026-98432 and PHP2Shell (CVE-2026-109618, CVE-2026-109619).