21 days after CVSS 9.8 Linux kernel flaw, Ubuntu still hasn't patched it
sergeykarayev · x · 2026-11-06
Sergey Karayev calls out Ubuntu's patch response: CVE-2026-98432, a CVSS 9.8 flaw in the Linux kernel's TCP code that has existed since 2016 and can be hit remotely, was publicly disclosed 21 days ago — and Ubuntu still ships no patch, with every supported release (LTS included) listed as vulnerable.
- Anthropic says it built a working exploit that gets root on a server — total takeover.
- Debian patched it the next day (Oct 16); volunteer-run distros Arch and Alpine also shipped fixes.
- The irony: Canonical sells security subscriptions and promises "timely patches for critical vulnerabilities," yet trails volunteer communities by weeks.
The author says he's lost all trust in Ubuntu and is migrating all his servers off it.
More from Infra
- Nvidia chips pile up in Hong Kong as China withholds import approval — pstAsiatech · 2026-11-06
- Chart: UK IT investment at 0.66% of GDP vs US 2.21%, missing the AI capex boom — KeeganMcB · 2026-11-06
- Kimi K3.1 Pro gets Day-0 TPU support: serving a 2.8T-param MoE with llm-d on TPUs and GPUs — vllm_project · 2026-11-06
- Level1Techs: CUDA porting lags while AMD's R9700 turns out surprisingly fast — Thrumpwart · 2026-11-06
- Satirical pitch: cool data centers with fluorinert and market them as 'water-free' — typedfemale · 2026-11-06
- US stocks lost $3.8T in a day; chipmakers took $1.15T of the hit — CharlieMuirhead · 2026-11-06