Ubuntu delays patch for critical Linux kernel RCE CVE-2026-98432
Nearly three weeks after disclosure, Ubuntu LTS kernels 22.04, 24.04, and 26.04 remain unfixed for a CVSS 9.8 vulnerability.
What to know
- Ubuntu has left its three most recent LTS releases (22.04, 24.04, 26.04) without patches for CVE-2026-98432, a CVSS 9.8 critical RCE, nearly three weeks after disclosure.
- The company has provided no estimated timeline for fixes and no official mitigation guidance, unlike Red Hat which published partial workarounds.
- Administrators face a choice: maintain vulnerable systems, manually apply iptables/nftables rules that do not fully prevent exploitation, or migrate to other distributions.
- The delay is eroding trust in Ubuntu's security practices and prompting some users to consider switching to Debian or other alternatives.
The dispute Whether the three-week delay reflects inexcusable negligence (forcing users to seek workarounds) or a defensible deferral pending broader updates (acceptable given no known public exploits). · positions read across 27 posts and comments
Ubuntu's failure to patch quickly and provide guidance is a serious breach of trust and reason to switch distributions.
-
“I was previously Ubuntu-by-default for my random Linux boxen, but going to upgrade things and finding that Ubuntu didn't have a patch has shaken my faith in it.”
jimrandomh · Hacker News ↗
The risk is overstated; no public exploits exist and mitigations are available, making the delay less urgent.
-
“I have not seen an exploit in the wild. I have at least 20 different servers unpatched (obviously) but the risk is blown way out of proportion. There are a number of mitigation options available.”
pelagicAustral · Hacker News ↗
Ubuntu should have published official mitigation steps like Red Hat did, even if a full patch is delayed.
-
“They also don't provide any mitigation possibilities or instructions... RHEL has one method here”
majorchord · Hacker News ↗
Ubuntu / Canonical Linux distribution maintainerRed Hat Competing Linux distribution
How it unfolded 0 developments, newest first · click a bar or a number to jump
-
background
Users question Ubuntu's strategic choices and consider migration — Comments on Hacker News reflect broader skepticism about Ubuntu's stewardship: some cite this incident as reason to switch to Debian, others question whether Ubuntu's philosophical contradictions explain the delay, and some express loss of faith in Ubuntu's security posture.
-
background
Administrators report concerns about lack of official patches and mitigation guidance — Hacker News discussion surfaces frustration over the delay and Ubuntu's failure to provide mitigation instructions, contrasting with Red Hat's published workarounds. Users debate whether the risk is justified or exaggerated and discuss switching to Debian.
-
background
Ubuntu confirmed to have not released patches for affected LTS releases — After nearly three weeks, Ubuntu has shipped no patched kernels for CVE-2026-98432 across its 22.04, 24.04, and 26.04 LTS releases, and has announced no ETA for fixes. Red Hat's RHEL has published partial mitigations using nftables that reduce but do not fully prevent exposure.
-
background
CVE-2026-98432 disclosed: critical Linux kernel RCE — A critical remote code execution vulnerability in the Linux kernel surfaces, rated CVSS 9.8. The vulnerability affects privilege boundaries and isolation in internet-facing and multi-tenant systems.
What people are saying 24 voices from 1 site · best of 27 · verbatim
- What is the official reason Ubuntu has not released patches after nearly three weeks?
- Why does Red Hat claim nftables mitigations 'cannot fully prevent' the vulnerability without elaboration?
- Should administrators building in iptables/nftables rules treat those as sufficient protection, or are they incomplete?
- Nov 3
-
That still leaves IPv6 vulnerable:> tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.
-
I installed newest mainline kernel, it did work for me.sudo add-apt-repository ppa:cappelikan/ppa -ysudo apt updatesudo apt install mainline -ymainline checkmainline install 7.3.1sudo apt -f installreboot
-
many news stories fail to mention mitigations, i wished there was more discussion about mitigation over 'just patching'
-
It is open source, those complaing, have they given any money to sponsor the fix?Yes, they should probably by now have shipped it, yet all those complaints are the usual entitled folks that only leech distros.
-
Just patched it everywhere on my servers last night. It’s getting increasingly more difficult to run things exposed to the internet, I get so many “sorry we’ve been hacked your data was stolen” e-mails recently it’s crazy, we must have armies of people combing through the web with AI attack tools.
-
This is the final nail in the coffin. I already order my new vservers with debian. I'll keep the existing ones on ubuntu for now, but will not consider ubuntu for anything server side in the future. My reasoning was "Debian is volunteers, they probably won't release fixes as fast as a commercial entity" - obviously the reasoning is backwards.But I…
-
It's one of the major selling points of Linux that Linux admins can do this even if their OS vendor won't, but the whole point of having a distro is to stop you from needing to roll your own solutions, or to have to maintain constant vigiliance to be even remotely secure.
-
At this point, just the failure to patch this single vulnerability is enough to make me write Ubuntu off as a viable distribution. Volunteer-run distros can fix this, why not a well-resourced company? It's not as if they haven't had the time to fix it, or that porting the fix to their current kernels would be particularly difficult.
-
For anyone that doesn't know, this reads the header and drops the packet if the length isn't 5*4 bytes, meaning it includes options.
- Nov 2
-
tl;dr: What is a good vm/container tool (and OS to live inisde that) for a 16GB RAM m1 pro mac that doesn't guzzle up the resources and is safe/easy enough.-----I am thinking of setting up a VM/container on my 16GB M1 Pro mac. The purpose mainly is to move harnesses (and the world of NPM et al) to it. Currently I am using few harnesses – Pi…
-
I also add the same rule for OUTPUT to prevent any misbehaving apps from trying to break things.Red Hat also claims that netfilter is not enough: https://access.redhat.com/security/vulnerabilities/RHSB-2026...> The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but…
-
I respect that there is a quick fix I can do myself with iptables. However, I don't want to have to do that. I run Ubuntu with automatic security patches enabled, I trust the Ubuntu team to issue quick fixes and my server to be patched most of the time while I am asleep. I don't want to have to manually edit my server configuration to patch…
-
Silly those who use Ubuntu in 2026.Ubuntu abandoned its way years ago, closing source, centralising features under Canonical umbrella., etc.Seeing people complaining about Ubuntu tells me more about them than the company itself.
-
I have been running pure Debian for years on my router/home server. Ubuntu is a superset of Debian that adds mostly adds stuff that is irrelevant for a networking device. Just stick to base distributions unless you are a very good reason not to.
-
Does a normal "default deny all incoming" rule with e.g UFW or nftables achieve the same thing?
-
I find it odd that no public discussions are highlighting that iptables or nftables can drop this before the kernel CVE is exploitable by a U32 drop rule in raw PREROUTING...sudo iptables -t raw -I PREROUTING -p tcp -m u32 ! --u32 "0>>24&0x0F=5" -j DROP
-
RIPUbuntu was always the benefits of Debian without the inconvenient restrictions anyways, it wouldn't be surprising if their contradictive philosophy caused them to collapse by inability to eat the cake while having it simultaneously.I've switched to Debian in professional servers around the time I learned how to use it without a Graphical…
-
I was previously Ubuntu-by-default for my random Linux boxen, but going to upgrade things and finding that Ubuntu didn't have a patch has shaken my faith in it. I probably won't choose it for new servers in the future.
-
Can't tell if Ubuntu is smart for deferring this patch until a bigger periodic release because there's no evidence it's been exploited and its exploitability is quite limited or if Ubuntu is dumb because there's a lot of publicity around this CVE and it comes off as failing to read the room.
-
Question:Every consumer router-wirelessAP I've seen runs linux.I never see security upgrades for the kernels they use. Not one. Not ever.Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.Update: The context which I should have said is that I think LLMs are…
-
I have not seen an exploit in the wild. I have at least 20 different servers unpatched (obviously) but the risk is blown way out of proportion. There are a number of mitigation options available.
-
It's rather uninteresting to note, once again, that Ubuntu has decided to do this. I would like to know the (official, if any - unofficial/speculative otherwise) reason WHY they have not.It does not seem that complicated to patch, and kernel upgrades are a dime a dozen these days. So what is making them delay a fix for so long?
-
For those not aware: Freenode.net is not Freenode as we all knew and loved it from the early 2000s to 2021. A hostile take-over of the Freenode LLC resulted in the loss of the domain name and some corporate assets. And the hostile takeover person, Andrew Lee, deleted the Freenode database. It no longer exists."Freenode" in 2026 is an entity…
-
They also don't provide any mitigation possibilities or instructions... RHEL has one method here: https://access.redhat.com/security/vulnerabilities/RHSB-2026...However they also claim the mitigation "reduces exposure to this vulnerability but cannot fully prevent it", without elaborating on what that means or how it would be possible... I've also…