Ubuntu has not released a patch for CVE-2026-98432, a critical remote code execution vulnerability scored CVSS 9.8, affecting 22.04, 24.04, and 26.04 LTS releases. Despite the severity, no fixed kernels are available, leaving internet-facing and multi-tenant systems exposed. The delay—now nearly three weeks—has left administrators without official vendor updates or an estimated time of arrival (ETA) for fixes.
In the interim, operators must decide whether to remain on stock kernels, apply out-of-tree mitigations, or migrate workloads to patched systems. The absence of a timely response raises concerns for organizations relying on Ubuntu LTS for security isolation and privilege boundaries.
Source: Hacker News · Summarized by HeadlinesBriefing