TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report says Ubuntu has not released fixed kernels for CVE-2026-98432 for Ubuntu 22.04, 24.04 or 26.04, despite the vulnerability’s reported CVSS 9.8 score. Ubuntu has not announced an ETA, and the available source material does not establish the flaw’s exploit conditions or whether attacks are occurring.
A report by Freenode News says Ubuntu has not released patched kernels for CVE-2026-98432 in Ubuntu 22.04, 24.04 and 26.04, leaving users of those releases without an official kernel update for the vulnerability. The report assigns the flaw a CVSS score of 9.8 and says the wait has lasted nearly three weeks, but Ubuntu has not announced a fix date in the material provided.
The report says no fixed kernel packages are available for the three listed Ubuntu releases. Administrators using their standard Ubuntu kernels therefore have no vendor-provided package identified by the report as closing the issue. The supplied material does not include a Canonical security advisory, affected kernel versions, or package references that would allow readers to independently check the status across specific system configurations.
The source characterizes CVE-2026-98432 as a remote code execution vulnerability and calls it critical, citing a CVSS 9.8 rating. Those details are claims in the report; the material supplied here does not describe the vulnerability’s technical cause, attack requirements, or whether an unauthenticated remote attacker can exploit it. It also provides no evidence that the flaw is being used in active attacks.
According to the report, Ubuntu has not given an estimated release date for corrected kernels. It says administrators may have to keep using the stock kernel, consider out-of-tree mitigations if available, or move workloads to a release or kernel with a fix. Those are options described by the source, not confirmation that a suitable mitigation or patched alternative has been verified for every affected installation.
Kernel Update Gap for Ubuntu Hosts
The reported delay matters because the Linux kernel is a core part of an operating system, and kernel vulnerabilities can affect the security boundaries relied on by applications and system users. If the report’s characterization and severity score are accurate, organizations may need to review exposure while they wait for an official package. The practical risk will depend on the flaw’s actual exploit conditions, which are not detailed in the supplied material.
The report singles out internet-facing and multi-tenant systems, where a vulnerability could have consequences across services or users sharing a host. That is a warning about possible exposure, not evidence that all such machines are exploitable or compromised. Administrators should avoid treating the headline score alone as proof of an attack path and should consult Ubuntu’s advisories for system-specific guidance.
Without a vendor fix or clearly documented mitigation, teams must weigh the risk of changing kernels or workloads against the risk of continuing with their existing setup. Unverified changes can create operational problems, while waiting may leave a vulnerable system in service if the reported conditions apply. The key unresolved need is authoritative, actionable guidance tied to affected versions.
Products Worth Considering
Samsung Odyssey G4 25-inch FHD Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Which Ubuntu Releases Are Named
The report names Ubuntu 22.04, 24.04 and 26.04 as releases without patched kernels. It describes them as LTS releases and frames the issue as a gap in Ubuntu’s kernel updates. The supplied source does not list kernel package versions, explain whether every kernel variant is affected, or identify whether other Ubuntu releases have received a fix.
The headline says the delay is almost three weeks, but the source material provided does not give a publication date or a timeline showing when the vulnerability was disclosed to Ubuntu. It also does not include the vulnerability’s original advisory, CVSS vector, or an independent technical analysis. Those missing details limit what can be concluded about the exposure and how the reported delay compares with the vulnerability’s disclosure history.
The report recommends that administrators consider stock-kernel use, possible external mitigations, or moving workloads to patched releases or kernels. It does not name a confirmed workaround or identify a specific alternative kernel that is known to fix CVE-2026-98432. Until a vendor advisory or technical documentation is available, those suggestions should be treated as options to investigate rather than established remedies.
“No patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.”
— Freenode News
Exploit Details and Fix Status
The supplied material does not include an Ubuntu or Canonical advisory confirming the affected packages, vulnerability mechanics, or remediation status. It also does not provide the CVSS vector behind the reported 9.8 score, so the circumstances needed for exploitation cannot be assessed from this source alone.
It remains unclear whether the flaw is exploitable remotely without authentication, whether proof-of-concept code exists, or whether attackers are exploiting it. The source labels the issue an RCE, but offers no supporting technical details. The exact disclosure date and the basis for the nearly three-week timeline are also not stated.
The report says no patched kernels are available for the named releases, but the supplied material does not establish whether a fix exists in another Ubuntu kernel channel or in a different distribution. It also does not identify a tested workaround. Readers should treat those points as unconfirmed until Ubuntu publishes guidance or further technical evidence is available.
Watch for Ubuntu Kernel Advisories
The next concrete development would be an Ubuntu security advisory or package announcement identifying affected kernel versions, corrected packages and any supported mitigation. No release date is supplied in the report, so administrators should not assume a patch is imminent or that a particular alternative kernel resolves the issue.
In the meantime, system owners can check Ubuntu’s official security notices and their installed package status, then assess whether their systems match the affected configurations once those details are published. Any change to kernels or workloads should follow the organization’s testing and change-control process, particularly where service availability depends on the host.
Further reporting will need to establish the vulnerability’s technical requirements, whether exploitation has been observed, and when fixed packages become available for each named release. Until those facts are confirmed, the reported severity warrants attention, but the scale and immediacy of the risk remain uncertain.
Key Questions
Which Ubuntu versions does the report say are affected?
The report names Ubuntu 22.04, 24.04 and 26.04 as lacking patched kernels for CVE-2026-98432. It does not list affected kernel package versions or confirm whether every kernel variant is affected.
Has Ubuntu announced when the fix will arrive?
Not in the source material provided. Freenode News says no ETA has been announced, and it does not cite a scheduled package release.
Is CVE-2026-98432 being exploited?
The supplied report does not say that attacks have been observed. It characterizes the issue as a remote code execution vulnerability, but gives no evidence about active exploitation or proof-of-concept code.
What should administrators do while waiting?
The report suggests reviewing whether to stay on the stock kernel, investigate possible out-of-tree mitigations, or move workloads to a kernel or release that is patched. It does not confirm a particular workaround, so administrators should check official Ubuntu guidance before making changes.
Source: freenode.net
