If you run Ubuntu on a server, go check your kernel version right now. I’ll wait.
Done? Good. Because the Ubuntu kernel patch delay everyone’s yelling about this week isn’t some obscure corner-case bug. We’re talking about CVE-2026-98432, a remotely reachable hole in the Linux kernel’s TCP stack that’s been sitting there since 2016, rated 9.8 out of 10 on the CVSS scale. And it’s not theoretical either: Anthropic’s security researchers built a working exploit that gets root on a server, with no credentials, from the network.
Debian shipped a fix on October 16. Arch did. Alpine did. Red Hat put out an advisory. And Ubuntu? As of November 2, every supported release, LTS included, still showed up as “Vulnerable” on Canonical’s own security tracker.
The Ubuntu kernel patch delay, in numbers
The whole thing blew up thanks to a short, furious blog post titled, quite simply, WTF Ubuntu?, which racked up well over a thousand points and nearly 600 comments on Hacker News in a day. The author’s maths is brutal: “Ubuntu hasn’t shipped the patch nine days after it was rated 9.8 and six days after a working root exploit.” His conclusion is just as blunt: “I’m moving all my servers off Ubuntu. I’ve completely lost trust in it.”
The irony he points at is hard to miss. Ubuntu’s server page promises “timely patches for critical vulnerabilities”, the enterprise-grade pitch, the whole Ubuntu Pro upsell. Meanwhile, in his words, distros run by volunteers shipped the fix while the one backed by a company with paying customers didn’t. Ouch.
Is it really that bad?
Let me be fair for a second, because the HN thread isn’t one-sided. Canonical’s tracker lists the bug as “Priority: High” rather than Critical, and a few kernel people argue the 9.8 score oversells the real-world risk (Greg Kroah-Hartman has been grumbling for a while that LLM-discovered CVEs tend to get inflated scores). Some commenters also report that fixed kernels are sitting in the “proposed” repos for each LTS, which is one step away from actually reaching your apt upgrade.
Fine. Maybe it’s a 7, maybe it’s a 9.8. But here’s the part I can’t excuse: nobody from Canonical said anything. No advisory, no “we’ve assessed this and here’s why we’re taking our time”, no ETA. One commenter summed it up perfectly: “If Ubuntu disagrees, they should have said something.” Silence is a terrible security policy, especially when the bug has been public for weeks and the exploit exists.
And that’s the real lesson, beyond Ubuntu. When a vendor sells you “timely” as a feature, the clock starts the moment the CVE drops, not when their internal process gets around to it. Debian, with zero marketing budget, understood that.
What I’d do if I were you
Don’t nuke your Ubuntu boxes in a panic. Check whether the patched kernel has landed in the proposed pocket for your release, and if your servers are internet-facing, seriously consider enabling it or temporarily tightening your firewall on exposed TCP services until the official update lands. If you’ve got Ubuntu Pro, now’s a good time to ask your account manager what exactly you’re paying for. And if you’re the kind of person who was already eyeing a leaner server distro, well, the universe just handed you an excuse.
Oh, and Canonical: a blog post would’ve cost you less than this thread did.
Turns out the most dangerous thing about a critical bug is a vendor that goes quiet.
Discover more from TechPassion
Subscribe to get the latest posts sent to your email.
