The first site on compromise_1.txt seems to be running "Apache/2.2.26 (FreeBSD) DAV/2 mod_ssl/2.2.26 OpenSSL/0.9.8y", which does not quite sound like it'd be running Linux at all. As others have already pointed out, I would not blame this on a Linux kernel bug yet.