Ubuntu leaves its LTS kernels unpatched for a CVSS 9.8 remote code execution flaw
Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks
Nearly three weeks after disclosure, Ubuntu has shipped no fixed kernel for CVE-2026-98432, a CVSS 9.8 vulnerability, leaving 22.04, 24.04, and 26.04 LTS without a vendor update and no announced ETA. Internet-facing and multi-tenant self-hosted hosts that depend on LTS kernels for isolation and privilege boundaries remain exposed, and administrators must choose between the stock kernel, out-of-tree mitigations, or moving workloads to already-patched releases.
Until packages appear, those hosts remain exposed to whatever remote or local attack the CVE enables.
- jimrandomh
I was previously Ubuntu-by-default for my random Linux boxen, but going to upgrade things and finding that Ubuntu didn't have a patch has shaken my faith in it. I probably won't choose it for new servers in the future.
- c0l0
It's rather uninteresting to note, once again, that Ubuntu has decided to do this. I would like to know the (official, if any - unofficial/speculative otherwise) reason WHY they have not.
It does not seem that complicated to patch, and kernel upgrades are a dime a dozen these days. So what is making them delay a fix for so long?
- harry8
Question:
Every consumer router-wirelessAP I've seen runs linux.
I never see security upgrades for the kernels they use. Not one. Not ever.
Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.
Update:
The context which I should have said is that I think
LLMs are giving script kids nation state level tools and expertise. This known bug is always less interesting than the next twenty.
- TZubiri
RIP
Ubuntu was always the benefits of Debian without the inconvenient restrictions anyways, it wouldn't be surprising if their contradictive philosophy caused them to collapse by inability to eat the cake while having it simultaneously.
- majorchord
They also don't provide any mitigation possibilities or instructions... RHEL has one method here: https://access.redhat.com/security/vulnerabilities/RHSB-2026...
However they also claim the mitigation "reduces exposure to this vulnerability but cannot fully prevent it", without elaborating on what that means or how it would be possible... I've also not seen anyone else make this claim.