Ubuntu Has No Patch for a 9.8 Kernel Bug Debian Fixed on October 16
CVE-2026-98432 is a remote 9.8 in the kernel's TCP code; Debian patched it on October 16, and every supported Ubuntu release, LTS included, is still listed vulnerable.
Ubuntu has left a remotely reachable 9.8 kernel bug unpatched on every supported release, LTS included, more than two weeks after Debian fixed it. CVE-2026-98432 lives in the Linux kernel’s TCP code and has been there since 2016, so it is not some odd configuration. It can be hit over the network, and Anthropic says it built a working exploit that gets root.
Debian shipped its patch on October 16. As of 2026-11-02 14:48 UTC, Ubuntu still lists every supported release as vulnerable. That is nine days after the bug was rated 9.8 and six days after a working root exploit existed, which is the wrong side of any window I’d accept. Canonical’s website promises “timely patches for critical vulnerabilities.”
Skip it if your fleet is Debian and patched since the 16th. The interesting part is who did the work: Debian, Arch and Alpine — volunteer-run distributions — shipped the fix, while the company selling security subscriptions did not. That is a trust problem, not a scheduling problem. I keep a short list of vendors I will defend in an argument, and this week it got shorter.
I have run Ubuntu on servers precisely because it was the boring choice, and a bug fixed everywhere else does more damage to that reputation than any missing feature. Reputation in this business is earned on the quiet days and spent on days like this. The picture I keep returning to is a row of machines powered down because there was no patch and no time to migrate. Pull your host inventory today and mark every Ubuntu box.