Ubuntu delays critical Linux kernel patch while competitors ship fixes
CVE-2026-98432, a CVSS 9.8 remote-root vulnerability in TCP code, has been patched by Debian and volunteer-run distros but remains unpatched in Ubuntu.
What to know
- A CVSS 9.8 remote-root vulnerability (CVE-2026-98432) in the Linux kernel's TCP code has gone unpatched in Ubuntu for over two weeks after disclosure, despite the availability of a working exploit and Canonical's marketing promise of 'timely' critical security patches.
- Debian, Arch, Alpine, and Amazon Linux 2 have all released fixes, making Ubuntu's delay unusual for a major distribution with commercial backing and security subscription offerings.
- Ubuntu's security page lists the vulnerability as 'High' rather than 'Critical' priority and provides minimal explanation, drawing criticism that the classification appears inconsistent with the CVSS score and real-world risk.
- Developers are publicly reconsidering Ubuntu adoption on servers, citing loss of trust in the distribution's security responsiveness relative to volunteer-maintained alternatives.
The dispute Whether the vulnerability's real-world risk justifies the urgency demanded by commenters, or whether Ubuntu's 'High' classification is defensible despite the CVSS 9.8 score. · positions read across 49 posts and comments
Ubuntu's delay reflects operational failure and disqualifies it for production use; faster response is table stakes for a distribution with commercial backing.
-
“They're totally asleep at the wheel, it's malpractice. The pitch for RHEL is highly competent maintenance you can't get elsewhere”
klooney · Hacker News ↗
Ubuntu's delay raises legitimate questions about its competitive advantage relative to Debian, given that faster updates are supposed to be Ubuntu's core value proposition.
-
“Ubuntu is a Debian distribution that releases more often. A faster update cycle for their packages is basically their entire reason for existing.”
tux3 · Hacker News ↗
The real-world risk may not match the CVSS score; lack of reported compromises suggests the practical exploitability is lower than the rating indicates.
-
“Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.”
StrLght · Hacker News ↗
Ubuntu's problem—classifying the vulnerability as 'High' rather than 'Critical'—reveals process failure, with inadequate explanation and potential contradictions in the priority framework itself.
-
“It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice.”
BoppreH · Hacker News ↗
chalmovsky Developer and Ubuntu userCanonical Ubuntu maintainer and commercial Linux vendorAnthropic AI research companyDebian Volunteer-maintained Linux distribution
How it unfolded 1 development · click the chart to see its coverage articlespostscomments
-
1
Post gains traction on Hacker News, developer community responds
The critique reaches the HN front page with over 300 points and 127 comments. Multiple developers report confidence loss in Ubuntu, consideration of alternatives like Rocky Linux, and frustration that a company selling security subscriptions lags volunteer-maintained distributions.
“I'm moving all my servers off Ubuntu. I've completely lost trust in it.”
— chalmovsky -
2 outlets WTF Ubuntu?
first by HN Best, 6d ago · also HN Frontpage
-
N
WTF Ubuntu? https:// chalmovsky.com/posts/wtf-ubuntu In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover…
2 more of the top 3 · 49 posts in this stretch
-
The more I look at this the angrier I get. This is a CVE that Anthropic claims can get a Remote Code Execution on vulnerable systems, which includes default Ubuntu installs running any sort of Go server like Caddy. Bad enough that I shut down my personal website and self-hosted tools (sorry for any typos, my grammar checker is also down).And this…
-
Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:> Why is this CVE high priority?> See ubuntu cvss scoreThat's it, we don't even get a period on this TBD of a sentence. It's followed by a generic…
-
-
background
Developer publishes critique of Ubuntu's patching delay — A blog post highlights that Ubuntu has not shipped patches six days after the working exploit was disclosed and nine days after the vulnerability was rated critical (9.8), despite all supported LTS releases remaining marked vulnerable. The post notes that Debian, Arch, and Alpine—volunteer-run distros—have already patched the issue. Ubuntu's website lists the vulnerability as 'High' priority rather than 'Critical,' and offers no explanation.
-
background
Fixed kernels appear in Ubuntu 26 LTS proposed repository — Ubuntu 26LTS receives patched kernels in the updates/security repositories, but fixes are not promoted to default updates.
-
background
Anthropic discloses working root exploit for CVE-2026-98432 — Anthropic reports building a functional exploit that achieves complete server takeover via the vulnerability.
-
background
Debian releases patch for CVE-2026-98432 — Debian, a volunteer-run distribution, patches the critical vulnerability.
-
background
CVE-2026-98432 introduced in Linux kernel TCP code — A critical vulnerability is introduced in the TCP implementation and goes undetected for a decade, affecting virtually every Linux server on the planet.
What people are saying 21 voices from 1 site · best of 49 · verbatim
- Nov 4
-
E.g. Ubuntu 22.04 Linux kernel 5.15.0-203.213 was published in Canonical's proposed kernel PPA on October 26, 2026. So just enable Canonical's proposed repository, use APT pinning to prevent automatic installation of untested packages and install the patched kernel. I agree that they need to get quicker at pushing these updates into stable, but…
- Nov 3
-
I think this is more of a communications failure than anything. My understanding (happy to be corrected) is:1. That for this to be a DOS type exploit, the attacker needs to exploit a race condition over network, which is an incredibly unlikely event that one can't really force.2. For it to be a root exploit they need to craft the IP options with a…
-
For people who absolutely need to run 16.04, 18.04 and 20.04 without any further subscription, I recommend installing the signed kernel from 22.04 (as of right now only available in the -proposed repo). Worked fine for some 16.04 examplary machines I had around that are stuck and bumps the kernel to 5.15 (soon EOL, but maintained by ... canonical…
-
Hi all, representing Canonical's product team here. We have fixes available for Ubuntu 22.04 LTS and newer in the -proposed pocket which are being tested for stability. These can be applied by users and we published a blog with the details. We sincerely appreciate the feedback and will follow up as soon as we can with more information
- Nov 2
-
> I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.To be clear, Ubuntu Pro doesn't have the fix yet either.
-
To be fair: while critical (9.8) it has an EPSS score of <1% (probability of it being actually used). According to [1], [2], and others, at worst the issue results in a kernel crash or a denial of service. I read the post by Anthropic too, but something just doesn't reconcile there between everyone saying its a DoS, and Anthropic alone claiming…
-
Well, I did it. This was the straw that broke the camel’s back: I have moved over to Rocky Linux. I am more a RedHat user, and Ubuntu never felt really comfortable for me. I don’t like having to do incremental upgrades every two years or so; I would rather do a single big upgrade about once every 7-8 years and have a rock solid development…
-
It’s not a good look that Ubuntu is taking its time with this patch even for paying customers, but I do have to question how widely exploitable this is. If your site is mission-critical, it most likely has a load balancer or reverse-proxy in front of it that’s probably already filtering it out. Companies like AWS have already confirmed that their…
-
We were using ZFS in prod a few years ago, and there was a one-line patch to fix data loss issues.It took Ubuntu something like 6 months to “backport” it. I’m not at all surprised they are taking forever to patch a severity 11 wormable exploit.Mildly disappointed, but not surprised. Anyway, the ZFS thing (and, before that, widespread…
-
I'll add that they were a day or two late to patch the brotli issue, other than Ubuntu Pro LTS, which was still "under consideration" or whatever they called it, for another few days to a week. https://ubuntu.com/security/CVE-2026-111497 Now it says it's fixed, but on my old server I'm still not getting the updates for whatever reason (maybe I…
-
I don't think this is fair. They don't do a good job of pointing you at their rationale which is in their security score here[0]. I ultimately had to have claude translate the kernelese in to something my small brain could understand but this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers…
-
The fact that Ubuntu (still) hasn't patched this (despite the fact that I'm pretty sure Opus 5.5 could figure it out in a few minutes) is pathetic. And it's very annoying for me because I have two servers that I need to consider migrating off of it now because Ubuntu clearly doesn't care all that much about security vulnerabilities like this. Get…
-
" Anthropic says it built a working exploit that gets root on a server. A total takeover."From the linked Ubuntu CVE page" Vulnerable system - Confidentiality impact LowVulnerable system - Integrity impact LowVulnerable system - Availability impact High" suggesting it's more of a denial of service. So which is it, there are dozens of kernel CVEs…
-
How about WTF linux?The TCP/IP stack has one of the most stable requirements bases of any component -- modern PCs can communicate with decades-old software and hardware, and the composition of layers design means the code can be easily tested, and is a great candidate for analysis via formal methods. And once you have a formally verified…
-
Yeah, their lack of a satisfactory response is the final nail in their coffin. This incident escalates my consulting advice about Ubuntu from “not recommended” to “switch immediately”.Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not…
-
For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:* https://launchpad.net/ubuntu/+source/linuxYou can pull them down with a "-t" added to your apt-get (but will not appear by default).26LTS had the new kernel go to the updates/security repos on October 28.
-
It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.Just a title…
-
The traditional answer is that Debian is a bit slower-moving in both the Linux kernel and userland, so people who want current versions of popular software often find that they have to do some extra work in Debian.A gradually increasing number of popular userland applications have been publishing their own apt repositories however so this is less…
-
Here is Ubuntu’s webpage on this vulnerability:https://ubuntu.com/security/CVE-2026-98432It’s still, over a week after disclosure and patches, unpatched in Ubuntu.As for me, a part of me wants to move over to Rocky Linux 10.
-
I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone…
-
I think it's just brand, ubuntu was what I knew from using it as a personal desktop and then it's the default/most obvious option for a lot of providers, I think even 10+ years ago AWS EC2 defaulted to it above Debian, digital ocean too I think?I don't remember why exactly but it was definitely just 'linux VPS = Ubuntu' for a long time. I think…