Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

Hacker News Top News

Summary

Ubuntu has yet to ship patched LTS kernels for critical CVE-2026-98432, a CVSS 9.8-rated Linux kernel RCE, leaving 22.04, 24.04, and 26.04 users exposed for nearly three weeks with no announced ETA for fixes.

No content available
Original Article
View Cached Full Text

Cached at: 11/02/26, 09:38 PM

# Ubuntu LTS kernels still unfixed for critical CVE-2026-98432 Source: [https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432](https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432) No patched kernels are available yet for 22\.04, 24\.04, or 26\.04 despite a CVSS 9\.8 rating\. Ubuntu has not shipped fixed kernels for[CVE\-2026\-98432](https://www.cve.org/CVERecord?id=CVE-2026-98432), a critical vulnerability scored CVSS 9\.8, leaving the 22\.04, 24\.04, and 26\.04 LTS releases without a vendor update\. Operators running those releases therefore have no official kernel package that closes the hole\. The gap matters most for internet\-facing and multi\-tenant self\-hosted systems that rely on Ubuntu’s LTS kernels for isolation and privilege boundaries; until packages appear, those hosts remain exposed to whatever remote or local attack the CVE enables\. Ubuntu has not announced an ETA for the fixes\. In the interim, affected administrators are left to decide whether to stay on the stock kernel, apply out\-of\-tree mitigations if any exist, or move workloads onto releases or kernels that already carry the patch\.

Similar Articles

WTF Ubuntu?

Hacker News Top

Ubuntu is criticized for failing to patch CVE-2026-98432, a critical CVSS 9.8 Linux kernel TCP bug with a working root exploit, more than two weeks after Debian and other distros shipped fixes, prompting the author to migrate servers off Ubuntu.

@tobi: What a disaster

X AI KOLs Following

Linux's stable kernels shipped fixes for CVE-2026-98432, a critical (CVSS 9.8) use-after-free in the IPv4 TCP handshake reachable by remote unauthenticated attackers; Anthropic reported the bug and says its Claude model wrote a working remote root exploit, while Ubuntu and RHEL remain unfixed.