Ubuntu Still Unpatched on a 9.8 Kernel Bug While Debian Already Shipped a Fix
WTF Ubuntu?
CVE-2026-98432 is a CVSS 9.8 flaw in the Linux kernel's TCP code, present since 2016 and remotely exploitable; Anthropic reportedly built a working root exploit. Debian patched it on October 16, but more than two weeks later every supported Ubuntu release, LTS included, is still listed as vulnerable. The author, who relied on Ubuntu as a no-drama server distro, has taken his servers offline and is migrating off it entirely.
Oh and btw, distros run by volunteers (Debian, Arch, Alpine...) have shipped the fix. Meanwhile Ubuntu, made by a company that sells security subscriptions, hasn't.
- BoppreH
Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:
> Why is this CVE high priority?
> See ubuntu cvss score
That's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.
I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.
[0] https://ubuntu.com/security/CVE-2026-98432#priority-reason
- throw0101c
For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:
* https://launchpad.net/ubuntu/+source/linux
You can pull them down with a "-t" added to your apt-get (but will not appear by default).
26LTS had the new kernel go to the updates/security repos on October 28.
- alentred
To be fair: while critical (9.8) it has an EPSS score of <1% (probability of it being actually used). According to [1], [2], and others, at worst the issue results in a kernel crash or a denial of service. I read the post by Anthropic too, but something just doesn't reconcile there between everyone saying its a DoS, and Anthropic alone claiming RCE. So far the advisories I read state "under specific conditions ... result in a kernel crash" and similar.
[1] https://app.opencve.io/cve/CVE-2026-98432
[2] https://aws.amazon.com/security/security-bulletins/2026-160-...
- paxy
It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.
The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.
Just a title designed to generate the maximum outrage followed by a few meaningless lines.
- vanschelven
I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone to care" phase which we all know so well...
- StrLght
Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.
Maybe it's time for StealMyBitcoinV2…
- strenholme
Well, I did it. This was the straw that broke the camel’s back: I have moved over to Rocky Linux. Took me maybe four hours to do the full transition.
I am more a RedHat user, and Ubuntu never felt really comfortable for me. I don’t like having to do incremental upgrades every two years or so; I would rather do a single big upgrade about once every 7-8 years and have a rock solid development environment. Also, `dnf` is simpler and more stable than the mess of `apt-get` and `unattended-upgrades`.
- strenholme
Here is Ubuntu’s webpage on this vulnerability:
https://ubuntu.com/security/CVE-2026-98432
It’s still, over a week after disclosure and patches, unpatched in Ubuntu.
As for me, a part of me wants to move over to Rocky Linux 10.
- bortimus
When AWS is shipping patches for Amazon Linux 2 and Ubuntu is still waiting.. yeah.
- imjonse
" Anthropic says it built a working exploit that gets root on a server. A total takeover."
From the linked Ubuntu CVE page
"
Vulnerable system - Confidentiality impact Low
Vulnerable system - Integrity impact Low
Vulnerable system - Availability impact High
"
suggesting it's more of a denial of service. So which is it, there are dozens of kernel CVEs fixed in the linked debian email.