Ubuntu Users Blast Canonical Over Slow Kernel Security Fix
Canonical is preparing a fix for a critical Linux kernel vulnerability, but the update has yet to reach Ubuntu’s stable repositories—weeks after Debian and several other distributions patched it.
As of 3 November, patched kernels for Ubuntu 22.04, 24.04 and 26.04 LTS were available for testing, but Canonical had not announced when they would be released to stable users.
A severe flaw affecting network connections
Tracked as CVE-2026-98432, the vulnerability is a use-after-free bug in the Linux kernel’s handling of incoming IPv4 TCP connections.
According to Red Hat’s security bulletin, an attacker could send specially crafted data to a vulnerable machine to crash it, cause a denial-of-service attack or potentially execute code with root privileges.
Servers are considered especially at risk. The bug may have existed since 2016, potentially leaving many Linux servers and cloud systems exposed. The Linux kernel CVE team rates it 9.8 out of 10 on the CVSS 3.1 severity scale, though Oracle and SUSE assign it a lower score of 8.1, citing the difficulty of exploitation.
The researcher who reported the flaw says an unreleased Claude model produced a working exploit that could give a remote attacker root access to vulnerable servers using Multipath TCP (MPTCP). The reported fix is described as a two-line change, adding to users’ frustration that Ubuntu’s update is still in testing while Debian’s patch was released weeks earlier.
Users criticize the delay
Ubuntu users have publicly criticized Canonical’s response, asking why the fix has taken so long. One developer, in a post titled “WTF Ubuntu,” said they were moving their servers away from Ubuntu because they had lost confidence in it as a secure and reliable platform.
The criticism is notable because Canonical sells enterprise support that emphasizes timely security updates, including through Ubuntu Pro and Extended Security Maintenance.
Canonical says kernel updates are tested across thousands of certified servers and devices before release. Administrators who need the fix sooner can enable the -proposed update repository and install the testing kernel. The company has also said that disabling MPTCP is not an appropriate workaround: the vulnerability is not limited to that feature, and a security update is the proper mitigation.
The delay may be connected to Canonical’s newer kernel security update schedule, which uses a fixed testing period intended to improve the release process. In this case, however, users argue that the process has not delivered the fix quickly enough.