Ubuntu LTS kernels unpatched for critical CVE after 3 weeks
Original: Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks
Why This Matters
A CVSS 9.8 kernel bug unpatched across all Ubuntu LTS releases is a significant exposure window.
Ubuntu has not shipped kernel fixes for CVE-2026-98432 (CVSS 9.8) across all three active LTS releases—22.04, 24.04, and 26.04—nearly three weeks after disclosure, with no ETA announced.
CVE-2026-98432, a Linux kernel vulnerability rated CVSS 9.8, remains unpatched on all three Ubuntu LTS branches as of October 31, 2026—nearly three weeks after it was disclosed. No fixed kernel packages are available for Ubuntu 22.04, 24.04, or 26.04. Ubuntu has not provided an estimated timeline for the fixes.
The exposure is most acute for internet-facing servers and multi-tenant systems where kernel-level isolation and privilege boundaries are security-critical. With no official vendor package available, administrators are left choosing between staying on a vulnerable stock kernel, applying unofficial out-of-tree mitigations where they exist, or migrating workloads to distributions or kernel versions that already carry the patch.
The CVE's 9.8 score indicates a near-maximum severity rating, typically associated with remote code execution requiring little or no authentication. Ubuntu has made no public statement on what is delaying the fix.