Canonical lags in patching critical CVE-2026-98432
Original title: Canonical's CVE Response Times
Canonical has not released the fix for CVE-2026-98432 in main Ubuntu repositories despite rapid patching by Debian and Red Hat.
Linux distributions followed a cautious policy that delayed publication of CVE-2026-98432 until October 15. Debian 12 and Red Hat RHEL8-10 issued patches quickly, while SUSE released updates by November 29. Ubuntu 13 was patched on November 2, but Canonical has not issued a fix for its main repositories as of November 3. The vulnerability carries a CVSS score of 9.8.
- Debian 12 patched October 17.
- Red Hat patched RHEL8-10 on November 1.
- SUSE Leap patched November 25.
- Ubuntu Pro users receive extended updates.
- Canonical fix only available in proposed pocket for kernel acceptance tests.
Impact: Critical vulnerability with CVSS 9.8
| Product | Affected |
|---|---|
| Canonical Ubuntu | — |
- 1.Upgrade to Debian 12 or Red Hat patches
- 2.Monitor Ubuntu Pro security updates
- CVEs
- CVE-2026-98432
- Organizations
- Anthropic
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
1 min read at aria.ripwas first published on October 15th, thanks to Linux's cautious CVE policy . On October 24th, after a blog post by Anthropic, it had a CVSS score of Since this was a critical vulnerability, patches and advisories
By aria.rip by ariaaaa · aria.rip
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.