Canonical delays critical Linux kernel TCP bug fix weeks after Debian, other distros

Canonical is testing patched kernels for CVE-2026-98432 across Ubuntu 22.04, 24.04, and 26.04 LTS as of November 3, but has not provided a release date for stable updates. The vulnerability is a use-after-free in the kernel's IPv4 TCP handshake code that allows remote attackers to crash systems, cause denial of service, or potentially achieve root code execution. The kernel CVE team rates it 9.8 on CVSS 3.1, while Oracle and SUSE assign 8.1 due to perceived exploitation difficulty. An Anthropic researcher reported that an unreleased Claude model generated a working exploit leveraging Multipath TCP (MPTCP), though the underlying bug is not MPTCP-specific. Other Linux distributions patched the issue with a reported two-line kernel change, amplifying user frustration over Ubuntu's multi-week delay.

The delay has drawn public criticism from system administrators and developers, with at least one viral blog post announcing a complete server migration away from Ubuntu citing lost trust. Canonical defends its timeline by citing testing across thousands of certified servers and devices, and notes that administrators can manually enable the -proposed pocket for earlier access. The company rejected disabling MPTCP as a sufficient workaround, stating that only a proper kernel security update adequately mitigates the flaw.

Vulnerability scope and Ubuntu patch status

• CVE-2026-98432: A use-after-free vulnerability in Linux kernel IPv4 TCP handshake handling, with the kernel CVE team assigning CVSS 3.1 score 9.8 and Oracle/SUSE scoring 8.1.
• Affected releases: Patched kernels are in testing for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS as of November 3, but have not reached the stable updates pocket.
• Exploitation vector: Remote attackers can send crafted network data to trigger crashes, DDoS conditions, or potential root code execution; an Anthropic researcher demonstrated a working exploit using MPTCP though the bug itself is not MPTCP-specific.
• Patch complexity: Other distributions reportedly resolved the issue with a two-line kernel change, contrasting with Canonical's extended testing cycle across thousands of certified hardware configurations.
• Mitigation posture: Canonical explicitly states that disabling MPTCP is not an adequate workaround and directs administrators to either wait for stable updates or manually enable the -proposed repository for earlier patching.

Why it matters

Ubuntu's delayed response to a trivially patchable, near-maximum-severity kernel vulnerability undermines confidence in its enterprise security commitments, particularly for Ubuntu Pro and ESM customers paying explicitly for timely updates. The incident highlights tension between Canonical's hardware certification breadth and security responsiveness, potentially accelerating migration evaluations among server and cloud operators who compared Ubuntu's weeks-long delay against same-day or near-same-day patches from Debian and other distributions. For Linux distribution security governance, the case raises questions about whether extended testing pipelines adequately balance stability guarantees against known-exploit conditions.