CVE-2026-98432, a critical Linux kernel TCP vulnerability rated CVSS 9.8, has existed since 2016 and affects virtually every Linux server. Anthropic researchers developed a working remote root exploit, enabling total system takeover.
Debian patched the flaw on October 16, and volunteer-run distributions including Arch and Alpine have also shipped fixes. However, Canonical's Ubuntu — which markets "timely patches for critical vulnerabilities" and sells security subscriptions — remains unpatched across all supported LTS releases as of November 2, more than two weeks after Debian's fix and six days after the exploit demonstration.
The author expresses total loss of trust, taking Ubuntu servers offline and migrating away. The delay is highlighted as especially egregious given Ubuntu's enterprise positioning and the fact that volunteer-run distros moved faster than a commercial vendor.
Source: Hacker News · Summarized by HeadlinesBriefing