Canonical is fixing a critical Linux kernel flaw in Ubuntu, weeks after Debian and other distros did – and users aren’t happy about the wait.
As of 3 November, patched kernels for CVE-2026-98432 are in testing for Ubuntu 22.04, 24.04 and 26.04 LTS, but are yet to hit the stable updates pocket. Canonical hasn’t given a date for when it expects them to.
What’s the issue, is it major and why are folks spitting feathers over the fact it hasn’t been patched?
A 9.8-rated CVE live on Ubuntu servers
The CVE involved a type of bug known as a use-after-free. It affects the part of the Linux kernel that handles incoming network connections, specifically the TCP handshake over IPv4.
In its security bulletin, Red Hat says an attacker could exploit the issue by sending specially crafted data to a vulnerable computer to crash it, DDoS it or, more worryingly, run code on it as root – yeah.
The most vulnerable systems will be servers, and this bug is believed to have been around since 2016. That means there are an awful lot of Linux servers and clouds out there that will be vulnerable, many of which run Ubuntu.
The kernel’s CVE team rank the flaw a 9.8 out of 10 on the CVSS 3.1 severity scale. Oracle and SUSE score it 8.1, as they consider it harder to exploit…
Claude’s went and made a working exploit
The Anthropic researcher who reported the bug in the first place has said an unreleased Claude model has created a working exploit which can give a remote attacker root access to affected servers using Multipath TCP (MPTCP).
It’s because of the severity of the flaw and the supposed simpleness of the fix, reportedly a two-line change, that has left many Ubuntu users rattled and rankled – not least because Debian patched it weeks ago.
‘Asleep at the wheel for weeks’
On social media, rebukes over Canonical’s tardiness have been thick, fast and unflinching.
“Zero explanation for why ubuntu has been asleep at the wheel for weeks”, writes one in response to a Canonical tweet that it was testing patched kernel. “RIP Ubuntu. Y’all been asleep at the wheel”, chides another.
One developer, in a viral blog post titled ‘WTF Ubuntu’, announced he was moving all of his servers off Ubuntu, saying they have now ‘completely lost trust’ in the distro as a reliable, secure platform for their needs.
Keep calm and apt update?
A lackadaisical approach to security is uncharacteristic of Canonical, a company that makes it money selling support to enterprises, businesses and cloud on the basis of “timely security updates” via Ubuntu Pro, ESM and other packages.
Canonical says it tests kernels on thousands of certified servers and devices before it releases anything, and says that admins can, if they wish, enable and install the -proposed update pocket to be patched sooner.
It also dismissed disabling MPTCP as a workaround, saying security updates are “the only appropriate mitigation” since the bug isn’t specific to that feature.
Oddly, it’s may company’s new kernel security cadence, introduced to get security fixes out to users, faster, that appears to be the cause of the delay. With kernel goes through a fixed testing period, the fixes come as fast as they can.
But not, it may seem, fast enough.
Instagram Engineering
Shopify Engineering