Ubuntu is 18 days behind Debian on a critical kernel RCE

Server admins running Ubuntu woke up to a CVSS 9.8 Linux kernel bug this week. Attackers are already scanning the public internet for it. There is still no stable Ubuntu kernel to install.

Debian released the fix on 16 October. Red Hat released it on 1 November. Ubuntu's security tracker, read on 3 November, still lists every supported release as work in progress.

The bug, CVE-2026-98432, is a use-after-free in the kernel's IPv4 TCP connection handshake. A remote attacker who sends a shaped TCP packet can get code execution as root. No authentication is needed. The flaw has been in the kernel since 2016. Security researchers at Anthropic built a working root exploit while mapping the bug with Claude.

What has been released where

Writing on 2 November, developer Jan Chalmovsky said he took servers offline because of the gap. "Timely patches for critical vulnerabilities" is one of Ubuntu's own promises, he wrote. The volunteer-run Debian release he compared Ubuntu to had the fix out 17 days earlier. He said he is moving his servers off Ubuntu to a distribution he trusts.

Ubuntu's security tracker on 3 November lists the kernel as work in progress for 26.04, 24.04 and 22.04 LTS. Older long-term releases are listed as vulnerable, with no planned fix date. Those are 20.04, 18.04 and 16.04. Early kernel builds for 22.04 LTS and newer sit in the -proposed pocket. The Ubuntu documentation describes that pocket as not for production use.

Debian published its patched kernel on 16 October. SUSE, Oracle Linux and Amazon Linux followed in the days after. Red Hat raised its own severity on this bug to Critical. It then released fixed kernels for RHEL 8, 9 and 10 on 1 November. AlmaLinux followed on 2 November.

What to do today

For a server on Ubuntu LTS, there are three realistic options. Install the kernel from the -proposed pocket at the risk of other regressions. Drop public IPv4 on the box. Or move the host to a distribution that has a stable fix out. Canonical, Ubuntu's commercial sponsor, has not published a reason for the delay.

Why this matters: the AI angle on this story is the exploit itself. Anthropic's researchers used Claude to find and chain the bug. That is one more datapoint. A defender who waits for a vendor patch is now racing against models in attackers' hands. The window between a kernel fix landing in Debian and a working exploit circulating is measured in days.

Source

Jan Chalmovsky, "WTF Ubuntu?"; Ubuntu Security, CVE-2026-98432.