Linux kernel flaw can be chained with two PHP bugs to plant webshells, NVD entry says
A missing variable initialization in the Linux kernel could let attackers alter page-cache-backed data, and the NVD entry says it can be chained with two PHP vulnerabilities to implant webshells and run commands as root.
A Linux kernel vulnerability could allow unintended modification of page-cache-backed data, and the National Vulnerability Database entry describing it says the flaw can be chained with two PHP vulnerabilities to implant PHP webshells and run commands as root.
According to the NVD text, the kernel issue is a missing initialization of a variable. The failure to preserve a shared-fragment marker during socket buffer coalescing causes ESP input processing to decrypt shared fragments in place. That is the mechanism the entry gives for the unintended modification of page-cache-backed data.
The chaining claim is the part worth noting. The entry names the two PHP bugs it says can be combined with the kernel flaw, and describes the combined outcome as webshell implantation and root-level command execution. That is a description of a possible attack path, not a report of an observed intrusion, and the entry does not say anyone has used it.
The same entry carries CISA remediation language: apply mitigations per vendor instructions, follow the agency's risk-based patching guidance, and discontinue use of the product if mitigations are unavailable. It also tells stakeholders to assess each asset's internet exposure.
For defenders, the practical takeaway is to treat the kernel and PHP fixes as one problem rather than two. Patching only one side of a chain leaves the other in place. Inventory internet-facing systems that run PHP, confirm which kernel and PHP versions they use, and check vendor advisories for the affected ranges and available fixes rather than assuming a version is safe. Where a fix isn't yet available, the entry's own guidance is to weigh exposure and follow the vendor's mitigation instructions.
CVE references
Sources
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning