Canonical Makes CVE-2026-98432 Fixes Available for Ubuntu in -proposed

Fixed kernel packages for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS are available in the -proposed channel. They have not yet moved to the regular updates repository.

Fixes for CVE-2026-98432 have been available since November 2 for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS in the -proposed repository. Canonical has not yet released them to the standard updates channel used by regular automatic updates. Ubuntu 26.10 already has the fix in its standard package.

The bug affects the IPv4 TCP portion of the Linux kernel. It is a network-exploitable use-after-free vulnerability that Canonical rates at 9.8 out of 10 under CVSS 3.1. The CVE record was published on October 15, 2026.

CVE-2026-98432 fixes are still in the testing channel

The -proposed repository is used for qualification testing of packages before they are moved to standard updates. Packages from this channel are not installed automatically. Administrators of Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS systems can therefore deploy them voluntarily, while systems using only the regular update channel are still waiting for the fix.

The system must be restarted after installing the fixed kernel. No date has yet been set for moving the packages for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS to the updates repository.

Which Ubuntu releases are affected

  • Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS: fixes are available in -proposed.
  • Ubuntu 26.10: the fix is available in the standard package.
  • Ubuntu 16.04 through 20.04: Canonical lists the status as “Fix pending” for the bug.

The announcement therefore does not change the fact that users of the standard updates channel for several supported releases have not yet received the fix. However, it is not accurate to claim that Ubuntu has not released a patch at all: Canonical has already prepared packages for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS in -proposed.

Exploit uses MPTCP, but the bug is not limited to it

Canonical states that a known, as-yet-undisclosed exploit uses MPTCP. According to the company, however, the vulnerability itself is not limited to MPTCP. Public active exploitation against Ubuntu users has not yet been confirmed.

Further developments will depend mainly on moving the fixed kernel packages to updates and releasing fixes for Ubuntu 16.04, 18.04, and 20.04. Any credible confirmation of public or active exploitation of the bug will also be important.

Sources

  • Ubuntu blog – On November 2, Canonical confirmed the availability of packages in -proposed, including specific versions for supported releases, the need for a restart, and the testing status before release to updates.
  • Ubuntu Security – CVE-2026-98432 – Confirms the CVE publication date, the technical description of the bug, the CVSS 9.8 rating, and a link to the upstream fix.

Verified and updated: 11/03/2026 06:35

Tags
Sharing

Súvisiace