Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks (freenode.net)

Article summary

Ubuntu has not released a patch for the critical Linux vulnerability CVE-2026-98432, despite its high CVSS rating of 9.8. This leaves Ubuntu LTS kernels for versions 22.04, 24.04, and 26.04 without a vendor update, exposing internet-facing and multi-tenant self-hosted systems to potential attacks. The lack of a patch or an announced ETA for the fix has left administrators to decide on their own mitigation strategies. Ubuntu's delay in releasing a patch has raised concerns among users and administrators.

Main themes

• Ubuntu patch delay
• Linux vulnerability
• Kernel security
• Mitigation strategies
• Open-source software
• Security updates

What commenters say

• The lack of mitigation possibilities or instructions from Ubuntu is concerning and may put users at risk.
• Some users have successfully updated their kernel from Ubuntu's proposed branch, which already has the fix, but it is unclear why it has not been merged into the stable branch.
• Using alternative operating systems, such as HardenedBSD, may provide better security for certain use cases.
• Security through obscurity is not a reliable solution and may not protect against determined attackers.
• The prevalence of unnecessary services listening on open ports may increase the risk of exploitation, and tightening security measures is essential.
• Disabling or removing unnecessary services, such as dhcpcd and avahi, can help reduce the attack surface.
• The delay in releasing a patch may be due to various reasons, but the official reason is not clear, leading to speculation and frustration among users.