WTF Ubuntu?
Summary
Ubuntu is criticized for failing to patch CVE-2026-98432, a critical CVSS 9.8 Linux kernel TCP bug with a working root exploit, more than two weeks after Debian and other distros shipped fixes, prompting the author to migrate servers off Ubuntu.
View Cached Full Text
Cached at: 11/02/26, 03:35 PM
Similar Articles
@tobi: What a disaster
Linux's stable kernels shipped fixes for CVE-2026-98432, a critical (CVSS 9.8) use-after-free in the IPv4 TCP handshake reachable by remote unauthenticated attackers; Anthropic reported the bug and says its Claude model wrote a working remote root exploit, while Ubuntu and RHEL remain unfixed.
Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks
Ubuntu has yet to ship patched LTS kernels for critical CVE-2026-98432, a CVSS 9.8-rated Linux kernel RCE, leaving 22.04, 24.04, and 26.04 users exposed for nearly three weeks with no announced ETA for fixes.
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
A critical Linux kernel TCP vulnerability with a 9.8 CVSS score has been disclosed, affecting Ubuntu, Red Hat, and other major distributions, prompting widespread patching efforts.
CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake path that could allow remote exploitation, with a Linux CNA CVSS of 9.8 and Red Hat's preliminary 8.1 score, while Anthropic's Frontier Red Team demonstrated remote root execution against an MPTCP listener; the article reviews patch validation and distribution-specific remediation steps.
High-severity vulnerability in Linux caused by a single faulty character
A single faulty character in the Linux kernel introduced a use-after-free vulnerability (CVE-2026-53111) allowing unprivileged users to escalate privileges to root on Debian and Ubuntu systems; the bug has been fixed and backported.