Ubuntu still has no patch for CVSS 9.8 kernel flaw

CVE-2026-98432 is a CVSS 9.8 flaw in the Linux kernel’s TCP code. It has been present since 2016, it is reachable over the network, and that combination means virtually every Linux server on the planet carries it. Anthropic says it built a working exploit that gets root on a server, which is a full takeover of the host.

Debian shipped a patch on October 16. As of 2026-11-02, more than two weeks later, Ubuntu has not. Every supported release, LTS included, is listed as Vulnerable. By the count in a post on chalmovsky.com that flagged this, Ubuntu was nine days past the 9.8 rating and six days past a working root exploit with no fix out, as of 14:48 UTC that day.

The uncomfortable part for Canonical is which distributions did ship. Debian, Arch, and Alpine, all run by volunteers, have the fix. Canonical sells security subscriptions and markets Ubuntu with phrases like “timely patches for critical vulnerabilities,” “enterprise-grade,” and “production grade.” A remote root bug at CVSS 9.8 with a working exploit is precisely the scenario those words exist to cover.

If you run Ubuntu servers, your current position is that you are exposed and the vendor has no patch. The bug is in the kernel’s TCP code and can be hit remotely. Until Canonical ships, the mitigations are the ordinary ones for a remote kernel bug you cannot fix: cut network exposure to the minimum, firewall off anything that does not need to face the internet, and watch the Ubuntu security tracker for the release.

The author of the chalmovsky.com post went further, pulling every Ubuntu server offline because there was no time to migrate services and data once the gap became clear, and is abandoning Ubuntu entirely after losing trust in a distribution used on servers mainly because it is the default image on most VPS providers. For an internet-facing host with no patch and a working root exploit, taking it off the network is the one control guaranteed to hold.