Ubuntu lacks a patch for critical kernel bug CVE-2026-98432, blogger says
In a post dated 2026-11-02, the author of chalmovsky.com (the source text does not name him) vents about Ubuntu's handling of CVE-2026-98432. He describes it as a critical bug, CVSS 9.8, in the Linux kernel's TCP code. By his account it has been in the kernel since 2016, so virtually every Linux server has it, and it can be hit remotely. He adds that Anthropic says it built a working exploit that gets root on a server, which he calls a total takeover. The post gives no link or further detail for the Anthropic claim.
The core complaint is timing. Debian patched the bug on October 16, he writes, and Ubuntu still has no patch more than two weeks later. Every supported Ubuntu release, LTS included, is listed as "Vulnerable". He sets that against Ubuntu's website, which promises "timely patches for critical vulnerabilities." In his telling Ubuntu had not shipped the patch nine days after the bug was rated 9.8 and six days after a working root exploit. The post does not reconcile these day counts with one another.
He then turns on Ubuntu's marketing language: "Timely," "Enterprise-grade," "Production grade," "Enterprise resilience. Developer velocity. Build with confidence on Ubuntu." He calls this blabber where words mean nothing and wonders who at Canonical is dedicated to writing it.
The practical outcome: he says he is moving all his servers off Ubuntu and has lost trust in it. He always disliked it on the desktop. On servers he mostly used it because it is the default on most VPS providers, and he had considered it the solid, no-drama LTS distro. Because he had no time to migrate his services and data when he learned of the bug, he took all his Ubuntu servers offline. The post does not say which distro he is moving to.
His closing point is a contrast. Distros run by volunteers (Debian, Arch, Alpine) have shipped the fix, while Ubuntu, made by a company that sells security subscriptions, has not. He says this is true as of 2026-11-02 14:48 UTC. No Canonical or Ubuntu response is given in the post.
Key facts
- The author says CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code, present since 2016 and remotely reachable.
- Debian patched it on October 16; as of 2026-11-02 14:48 UTC the author says Ubuntu has no patch, with every supported release, LTS included, listed as "Vulnerable".
- Per the author, Anthropic says it built a working exploit that gets root on a server.
- He quotes Ubuntu's website promising "timely patches for critical vulnerabilities" and contrasts it with the delay.
- He has taken all his Ubuntu servers offline and says he is moving off Ubuntu entirely.
Why it matters
If the author's account is right, a remotely reachable, root-level kernel flaw in a very widely deployed distro has gone unpatched for weeks while another major distro fixed it. The post also tests Ubuntu's public promise of "timely patches for critical vulnerabilities" against its own record, and it sets a company that sells security subscriptions against volunteer-run distros that shipped the fix.
Who it affects
Anyone running Ubuntu on servers. The author says every supported release, LTS included, is listed as "Vulnerable", and that he mostly used Ubuntu because it is the default on most VPS providers. Debian, Arch and Alpine users are, per the author, already covered by a shipped fix.
How to use it
The post offers no mitigation steps or patch reference. Its practical takeaway is the author's own response: he took his Ubuntu servers offline and is migrating away. Readers running Ubuntu would need to check the distro's own security tracker for the bug's status rather than rely on this post.
How solid is it
This is a personal blog rant, not an advisory. The CVE, the CVSS 9.8 rating, the Debian patch date and Ubuntu's status are all stated by the author without links. Anthropic's exploit claim is relayed as "Anthropic says" with no further detail. The day counts (more than two weeks, nine days, six days) are not reconciled with one another. Ubuntu's status is given as of 2026-11-02 14:48 UTC only.
Risks and caveats
No Canonical or Ubuntu response is given, and the post gives no patch ETA or Ubuntu tracker reference. It does not say whether the bug has been exploited in the wild. The tone is angry and the author's decision to take servers offline is personal, not a recommendation. Ubuntu's status may have changed since the snapshot time.
“Ubuntu's website promises "timely patches for critical vulnerabilities."”
— chalmovsky.com blog post, 2026-11-02