As of 3 November, patched kernels for CVE-2026-98432 are in testing for Ubuntu 22.04, 24.04 and 26.04 LTS, but are yet to hit the stable updates pocket. Canonical hasn’t given a date for when it expects them to.

…

The CVE involved a type of bug known as a use-after-free. It affects the part of the Linux kernel that handles incoming network connections, specifically the TCP handshake over IPv4.

…

A lackadaisical approach to security is uncharacteristic of Canonical, a company that makes it money selling support to enterprises, businesses and cloud on the basis of “timely security updates” via Ubuntu Pro, ESM and other packages.

Canonical says it tests kernels on thousands of certified servers and devices before it releases anything, and says that admins can, if they wish, enable and install the -proposed update pocket to be patched sooner.

It also dismissed disabling MPTCP as a workaround, saying security updates are “the only appropriate mitigation” since the bug isn’t specific to that feature.

Oddly, it’s may company’s new kernel security cadence, introduced to get security fixes out to users, faster, that appears to be the cause of the delay. With kernel goes through a fixed testing period, the fixes come as fast as they can.

But not, it may seem, fast enough.