Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks
- ID
- 42230
- Status
- summarized
- Published
- 03 Nov 2026, 2:39 AM
- Fetched
- 03 Nov 2026, 7:45 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.0
- Created
- 03 Nov 2026, 7:46 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Ubuntu has not shipped fixed kernels for CVE-2026-98432, a CVSS 9.8-rated vulnerability, leaving 22.04, 24.04 and 26.04 LTS without a vendor patch almost three weeks after disclosure — and no ETA has been announced. The article gives no detail on the attack mechanism or any out-of-tree mitigation, so affected operators only know that no official kernel package closes the hole. The Hacker News thread drew 232 points and 37 comments.
Why it matters
If you run Ubuntu 22.04, 24.04 or 26.04 LTS on internet-facing or multi-tenant hosts, there is currently nothing to apt-upgrade to — so rebuilding container images or rerunning your normal patch pipeline will not fix this, since the host kernel is the unpatched component. The decision in front of you is concrete: keep stock kernels and accept exposure on public-facing boxes, look for an out-of-tree mitigation, or move the exposed workloads onto a release or kernel that already carries the fix. Also worth noting for planning: the article states no ETA, so treat this as open-ended rather than a one-week blip.
Discussion angle
What is your tolerance window for an unpatched CVSS 9.8 on your public hosts — and who in your team actually checks whether the kernel, not just the app dependencies, has a vendor fix available?