Ubuntu delays critical Linux kernel TCP vulnerability patch
Original title: WTF Ubuntu?
Ubuntu has not patched CVE-2026-98432 which allows remote root on servers, despite Debian and others shipping the fix.
CVE-2026-98432 is a critical vulnerability in the Linux kernel's TCP code present since 2016. It can be exploited remotely to gain root access. Debian patched it on October 16 but Ubuntu still lists all supported releases as vulnerable more than two weeks later. The reporter is moving servers off Ubuntu due to the delay.
Unconfirmed: Whether Ubuntu will patch soon is unknown.
- CVSS 9.8 critical bug in Linux kernel TCP
- Working exploit for root access reported by Anthropic
- Debian patched on October 16
- Ubuntu not patched as of November 2
- All Ubuntu releases still vulnerable
Impact: remote root access via TCP code
- 1.Migrate servers off Ubuntu
- CVEs
- CVE-2026-98432
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
1 min read at chalmovsky.comIn case you missed it: CVE-2026-98432 is a critical (CVSS 9. 8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely.
By chalmovsky.com via br · chalmovsky.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.