Ubuntu’s kernel packages remain vulnerable to CVE-2026-98432, a Linux kernel flaw rated CVSS 9.8 and “Critical” that was published on October 15, 2026, according to Ubuntu’s security tracker, which was last updated on November 5. A blog post titled “WTF Ubuntu?” that criticizes the delay drew 1,627 points on Hacker News, and a separate article reported that Ubuntu had announced no ETA for fixes.

The flaw

Ubuntu describes a use-after-free in the kernel’s IPv4 TCP connection handling that “can lead to remote code execution”: memory holding IP options can be freed while another CPU is still using it. The proposed fix is to free it with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(), according to the page. Debian’s tracker describes the same fix and says IPv6 is not affected by the first issue and that a related issue in request-socket migration will be handled in a separate patch. The upstream fix is linked as a commit noted as 7.3-rc7.

Status by distribution, per the trackers

  • Ubuntu (linux package): 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS are listed as “Vulnerable work in progress,” with package versions 7.3.0-10.10, 7.0.0-43.43, 6.8.0-149.149 and 5.15.0-203.213 named in the entries; the page does not describe those as fixes. 20.04 LTS, 18.04 LTS and 16.04 LTS are listed as “Vulnerable,” and 14.04 LTS as “Not affected.” The page lists no fixed version or fix date, and the visible content was cut off partway through the list of related kernel packages.
  • Debian: fixed versions are listed for bookworm (6.1.190-1, advisory DLA-4841-1, and 6.12.113-1~deb12u1 for linux-6.12, DLA-4850-1), trixie (6.12.115-2; the data cites DSA-6568-1 for 6.12.113-1), forky (7.2.12-1) and sid (7.2.15-1). The page gives no dates or severity score.

The blog post and the reaction

The anonymous author of “WTF Ubuntu?” writes that Debian patched the bug on October 16 and that, as of 14:48 UTC on November 2, Ubuntu had no patch “more than two weeks later,” with supported releases listed as vulnerable. The author also writes that “Anthropic says it built a working exploit that gets root on a server”; Lens did not find a source for this claim in the other material it reviewed. The author quotes Ubuntu’s website as promising “timely patches for critical vulnerabilities” and says they are moving all servers off Ubuntu. The post includes no statement from Canonical. An article on freenode.net dated October 31 says Ubuntu had not shipped fixed kernels for 22.04, 24.04 or 26.04 LTS and had “not announced an ETA for the fixes”; it lists no mitigations and says administrators must decide whether to stay on the stock kernel, apply out-of-tree mitigations “if any exist,” or move workloads to releases or kernels that already carry the patch.

Sources and notes

This post is based on Ubuntu’s CVE-2026-98432 page and Debian’s security tracker as read on November 6, 2026, the “WTF Ubuntu?” post (dated November 2) and the freenode.net article (October 31), plus Hacker News counts. Lens did not test any kernel and did not find a Canonical statement. Ubuntu’s page may have changed since, so check it for the current status. The Anthropic exploit claim is the blog author’s and is unverified.

Image: a laptop screen showing an Ubuntu desktop with the Ubuntu logo and Tux wallpaper (screen artwork by Ubuntu and Canonical), by Solijon Solayev via Wikimedia Commons, licensed under CC BY-SA 4.0; cropped. Illustrative photo; it does not show the events described.