Ubuntu delays patch for Linux 0day RCE
The gist
Ubuntu had not shipped fixed kernels for CVE-2026-98432, a CVSS 9.8 flaw, as of Oct 31, 2026.
Long-term-support servers stay exposed while other distros already ship fixes.
How it unfolded
- Oct 29, 2026Ubuntu (16.04 through 26.10) and Red Hat Enterprise Linux (8, 9, 10) had not released patched kernels, while Amazon Linux 2023, Oracle Linux, Debian and SUSE had fixes for at least some kernel packages. No vendor advisory reported attacks in the wild.
- Oct 30, 2026Ubuntu's tracker was last updated with fixes in progress for 22.04, 24.04, 26.04 and 26.10; 20.04, 18.04 and 16.04 were listed as vulnerable with no fix.
- Oct 31, 2026Ubuntu still had not shipped fixed kernels for CVE-2026-98432, leaving 22.04, 24.04 and 26.04 LTS without a vendor update and no ETA announced.