AI Weekly Malaysia

Ubuntu has not shipped fixed kernels for CVE-2026-98432, a CVSS 9.8-rated vulnerability, leaving 22.04, 24.04 and 26.04 LTS without a vendor patch almost three weeks after disclosure — and no ETA has been announced. The article gives no detail on the attack mechanism or any out-of-tree mitigation, so affected operators only know that no official kernel package closes the hole. The Hacker News thread drew 232 points and 37 comments.

Why: If you run Ubuntu 22.04, 24.04 or 26.04 LTS on internet-facing or multi-tenant hosts, there is currently nothing to apt-upgrade to — so rebuilding container images or rerunning your normal patch pipeline will not fix this, since the host kernel is the unpatched component. The decision in front of you is concrete: keep stock kernels and accept exposure on public-facing boxes, look for an out-of-tree mitigation, or move the exposed workloads onto a release or kernel that already carries the fix. Also worth noting for planning: the article states no ETA, so treat this as open-ended rather than a one-week blip.

A blog post argues that CVE-2026-98432 — a CVSS 9.8 remote, root-level flaw in Linux kernel TCP code present since 2016 — was patched by Debian on October 16, while Ubuntu still listed every supported release, LTS included, as "Vulnerable" more than two weeks later, nine days after the 9.8 rating and six days after Anthropic reportedly produced a working root exploit. The author says they took their Ubuntu servers offline because they had no time to migrate, and is moving off Ubuntu entirely, contrasting Canonical's "timely patches" and "enterprise-grade" marketing with volunteer-run Debian, Arch and Alpine having shipped fixes. The post drew 580 points and 285 comments on Hacker News.

Why: If you run Ubuntu on VPS instances — the default at most providers — this is a concrete prompt to check your own hosts against Ubuntu's per-release CVE tracker instead of the marketing page, and to decide now whether you mitigate (restrict exposure on the affected TCP path), accept the risk, or migrate, rather than discovering the gap mid-incident. It also undercuts the assumption that a paid security subscription like Ubuntu Pro buys faster patching than free distros; the post's comparison is Debian patched Oct 16 vs. Ubuntu still unpatched on Nov 2. Treat it as one author's account and verify the patch status yourself before acting.