Ubuntu Lags 2+ Weeks on CVSS 9.8 Kernel Patch
Original: WTF Ubuntu?
Why This Matters
A CVSS 9.8 kernel flaw with a public root exploit exposes Ubuntu's patch SLA claims.
CVE-2026-98432, a CVSS 9.8 Linux kernel TCP flaw present since 2016, got a working root exploit from Anthropic. Debian patched it Oct 16; Ubuntu still showed all releases as 'Vulnerable' on Nov 2, 2026.
CVE-2026-98432 is a critical Linux kernel TCP vulnerability (CVSS 9.8) that has existed since 2016, exposing nearly every Linux server to remote exploitation. Anthropic confirmed it built a working exploit capable of achieving full root access. Debian shipped a patch on October 16. As of November 2, 2026 — over two weeks later — Ubuntu had not, with every supported release, including LTS, still listed as 'Vulnerable' on Canonical's own tracker. Volunteer-run distributions including Debian, Arch, and Alpine all delivered the fix first. The author, who runs multiple Ubuntu servers, took them offline rather than wait, then announced he's migrating entirely away from Ubuntu. The irony he points to: Canonical sells security subscriptions and markets Ubuntu with phrases like 'Enterprise resilience' and 'timely patches for critical vulnerabilities.' Nine days after the 9.8 rating and six days after a working root exploit became known, Ubuntu had shipped nothing.