Ubuntu’s CVE-2026-98432 Patch Is 18 Days Late — Act Now

Ubuntu remained unpatched for CVE-2026-98432, a CVSS 9.8 remote use-after-free in the Linux IPv4 TCP stack, 18 days after the upstream kernel fix landed on October 15, with Canonical listing 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as "Vulnerable, work in progress" as of November 2. Debian and Oracle Linux patched the flaw on October 16, SUSE on October 29, Amazon Linux on October 30, and Red Hat shipped RHEL 8, 9 and 10 fixes on November 1, according to the CVE-2026-98432 patch status tracker. Anthropic's Xinyang Ge used an internal Claude research model to build a working remote root exploit against MPTCP-listening servers in about 53 minutes — roughly 48 minutes to leak a kernel pointer and defeat KASLR plus 5 minutes to gain root — with no credentials or user interaction, and the code has not been published.

Ubuntu is still unpatched for CVE-2026-98432 — a CVSS 9.8 remote use-after-free in the Linux IPv4 TCP stack — 18 days after the upstream kernel fix landed on October 15. Debian patched in one day. Oracle Linux patched in one day. Meanwhile, Red Hat shipped fixes for RHEL 8, 9, and 10 on November 1. As of today, November 2, Ubuntu lists every supported release — 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 — as “Vulnerable, work in progress,” with no release date announced. Canonical markets Ubuntu as “enterprise-grade” with “timely patches for critical vulnerabilities.” However, a volunteer-run distribution just outpaced them by 17 days on a flaw that Anthropic’s internal Claude model demonstrated as a remote root exploit in 53 minutes, requiring no credentials and no user interaction. The developer community noticed. The “WTF Ubuntu?” post by Chalmovsky https://chalmovsky.com/posts/wtf-ubuntu hit 440 points on Hacker News and sat at 1 on the front page this morning. Ubuntu’s Patch Timeline Is Damning The upstream fix for CVE-2026-98432 merged into stable Linux branches on October 15. What happened next varies sharply by distribution. Debian had kernel packages in its security archive the next day, October 16. Oracle Linux did the same. Furthermore, SUSE shipped fixes on October 29. Amazon Linux followed on October 30. Red Hat closed the gap on November 1 with patches for RHEL 8, 9, and 10. Ubuntu? Still pending. All four active releases remain vulnerable as of this writing. For context, Canonical sells Ubuntu Pro with a formal 4-hour SLA for critical security incidents — yet the free, community-run alternative delivered a faster response. That gap is hard to explain away. Moreover, according to the CVE-2026-98432 patch status tracker https://patchmon.net/blog/cve-2026-98432-linux-kernel-tcp-use-after-free-patch , Ubuntu’s delay now exceeds every other major distribution. An AI Already Built the Exploit This isn’t theoretical. Xinyang Ge at Anthropic used an internal Claude research model to write a working exploit against servers with multipath TCP MPTCP listeners. The attack plays out in two phases: approximately 48 minutes to leak a kernel pointer and defeat KASLR, then another 5 minutes to achieve root-level command execution with no credentials and no user interaction. According to CyberSecurityNews https://cybersecuritynews.com/linux-kernel-flaw-root-commands/ , the exploit was demonstrated in a lab environment and the code has not been published. However, the exposure is broader than MPTCP alone. Go 1.24 enables MPTCP by default, so any Go service upgraded to Go 1.24 or later is in the higher-risk pool. In fact, CIQ’s testing found standard TCP connections also exploitable. The full scope of affected configurations is still being mapped — which makes Ubuntu’s silence on a patch timeline all the more frustrating for production operators. For the technical breakdown of the vulnerability itself, see our earlier coverage: CVE-2026-98432: Linux Kernel TCP Flaw — No Ubuntu Fix Yet https://byteiota.com/cve-2026-98432-linux-kernel-tcp-flaw-no-ubuntu-fix-yet/ . What Ubuntu Users Must Do Right Now There is no patch. Until Canonical ships one, these three steps reduce exposure on Ubuntu servers: - Check MPTCP migration: Run sysctl net.ipv4.tcp migrate req . It should return 0 the default . If it returns 1, set it back to 0 immediately — this closes the secondary exploit path. - Identify MPTCP listeners: Run ss -Mlnp to list any sockets using multipath TCP. These are your highest-risk services until the patch lands. - Filter Record Route options: Add an nftables rule to drop inbound IPv4 Record Route options: nft add rule inet filter input ip option rr exists drop . Note that Timestamp options cannot currently be blocked this way. When the Ubuntu security patch does arrive, installing the package alone is not enough — you must reboot into the patched kernel. Consequently, verify with uname -r that the running kernel matches the patched version. Additionally, no live patching solution has been confirmed for CVE-2026-98432, according to Rescana’s vulnerability analysis https://www.rescana.com/post/linux-kernel-tcp-cve-2026-98432-use-after-free-prepare-now . This Is Part of a Longer Pattern Ubuntu’s patch delay is frustrating on its own. In contrast, the context of Canonical’s recent decisions makes it land harder. APT has silently installed snap packages without user consent. Promotional messages have appeared in server terminals via MOTD. The Snap Store has suffered repeated malware incidents. Furthermore, CVE-2026-3888 — a CVSS 7.8 privilege escalation in snap-confine — exposed the snap subsystem itself to local root attacks. The community hasn’t forgotten. On Hacker News, one developer summarized the sentiment: “Starting from 12.10, when the Amazon ad appeared, I switched to Fedora. And it wasn’t a mistake.” The “WTF Ubuntu?” author reached the same conclusion this week, deciding to migrate all servers off Ubuntu after this incident. Therefore, for developers evaluating Ubuntu for new production deployments, this pattern deserves serious weight. Key Takeaways - Ubuntu is still unpatched for CVE-2026-98432 CVSS 9.8 as of November 2 — 18 days after the upstream fix, a day after RHEL shipped patches, and 17 days after Debian patched - An Anthropic Claude model demonstrated a working remote root exploit in 53 minutes; no auth required, and Go 1.24+ servers running MPTCP are the highest-risk targets - Three mitigations are available now: verify tcp migrate req=0 , audit MPTCP listeners with ss -Mlnp , and add an nftables drop rule for IPv4 Record Route options - When the patch ships, a full reboot is required — live patching is not confirmed for this CVE - This delay fits a broader pattern of Canonical prioritizing commercial initiatives over the security response speed its marketing promises