Fixes available in -proposed pocket for CVE-2026-98432
Comments on “Fixes available in -proposed pocket for CVE-2026-98432”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Canonical has put kernel fixes for CVE-2026-98432, a critical (CVSS 9.8) IPv4 TCP flaw that can allow remote code execution, into the -proposed pocket for Ubuntu 22.04, 24.04 and 26.04, with 26.10 already fixed. Older releases remain pending, and fixes reach the updates pocket only after testing on more than 2,000 certified devices. Canonical says disabling MPTCP is not a real mitigation. A blogger notes that Debian, Red Hat and SUSE shipped fixes earlier. The Anthropic-generated exploit is unreleased, and the claims here were not independently verified.
Why it ranked
No. 18 of 137 with a score of 0.72. The panel rated it highest on practical relevance (0.87) and audience breadth (0.78), lowest on new information (0.48). The judges disagreed most on new information (spread 0.52), so the story is marked contested. Placed No. 18, No. 10 by score alone: the fifth Security story of the day (−0.040), and close to “TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8”, No. 2 on Sunday 1 November 2026 (−0.033). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Critical Linux kernel RCE with a patch-availability advisory: highly actionable for operators and builders, but a vendor status page with little technical depth or independent verification.
- AI judgeJudge 3gpt-5.6-luna
- A highly actionable Linux kernel security advisory with affected releases, package versions, installation commands, and mitigation guidance. Its exact CVE and related mitigations already appeared in the recent coverage list, limiting novelty.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.72total under rubric v2.3Contestedjudges differ by 0.40 on technical depth, 0.52 on new information
- Significance0.77
- Reader interest0.77
- Audience breadth0.78
- Practical relevance0.87
- Substantiated0.62
- Technical depth0.56
- New information0.48
- Counts against: Promotional0.10
- Counts against: Overclaim0.18
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.71 | 0.80 | 0.78 | 0.77 | 0.09 | +0.24 | +0.184 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.60 | 0.85 | 0.86 | 0.77 | 0.26 | +0.26 | +0.200 |
| Audience breadthHow many people who build technology does it concern? | 0.81 | 0.80 | 0.72 | 0.78 | 0.09 | +0.13 | +0.101 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.80 | 0.90 | 0.90 | 0.87 | 0.10 | +0.22 | +0.190 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.45 | 0.60 | 0.82 | 0.62 | 0.37 | +0.05 | +0.031 |
| Technical depthHow technically substantive is it? | 0.80 | 0.40 | 0.48 | 0.56 | 0.40 , above the contested threshold | +0.05 | +0.028 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.76 | 0.45 | 0.24 | 0.48 | 0.52 , above the contested threshold | +0.05 | +0.024 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.12 | 0.05 | 0.12 | 0.10 | 0.07 | −0.19 | −0.018 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.22 | 0.15 | 0.18 | 0.18 | 0.07 | −0.11 | −0.020 |
| Sum of contributions | +0.720 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.720 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-04/18/"><img src="https://rubric.hrih.si/badge/2026-11-04/18.svg" alt="Ranked #18 on Rubric, 4 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 2 no source given · 6 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
CVE-2026-98432 has a CVSS 3.1 score of 9.8, corresponding to Critical severity.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The vulnerability has a CVSS 3.1 score of 9.8, corresponding to a severity of Critical”
The source says No passage could be compared.
Source cited by the article: ubuntu.com/security/CVE-2026-98432
Couldn’t checkVersion
CVE-2026-98432 is a flaw in how the Linux kernel sets up IPv4 TCP connections, present in Linux kernel versions 4.4 and later.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “a flaw in how the Linux kernel sets up IPv4 TCP connections, present in Linux kernel versions 4.4 and later”
The source says No passage could be compared.
Source cited by the article: ubuntu.com/security/CVE-2026-98432
Couldn’t checkVersion
Fixes for CVE-2026-98432 are available in the -proposed pocket for Ubuntu 22.04 LTS (5.15.0-203.213), 24.04 (6.8.0-149.149) and 26.04 (7.0.0-43.43), and 26.10 is fixed in 7.3.0-10.10.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Jammy (22.04) linux Fix available in -proposed (5.15.0-203.213”
The source says No passage could be compared.
Source cited by the article: ubuntu.com/security/CVE-2026-98432
No source givenNumber
Canonical performs tests on more than 2,000 certified servers and devices to ensure stability before releasing kernel fixes.
The article gives no link or citation for it.
The article says “we perform extensive tests on more than 2,000 certified servers and devices”
The source says No source to compare with.
Couldn’t checkCausal conclusion
The vulnerability can lead to remote code execution.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The vulnerability affects the IPv4 TCP connection handling in the Linux kernel and can lead to remote code execution”
The source says No passage could be compared.
Source cited by the article: ubuntu.com/security/CVE-2026-98432
Couldn’t checkQuote
An as-yet unreleased exploit generated by Anthropic is described as using Multipath TCP (MPTCP), though the vulnerability is not specific to MPTCP.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The yet-unreleased exploit generated by Anthropic is described as using Multipath TCP (MPTCP), although the vulnerability is not specific to MPTCP”
The source says No passage could be compared.
Source cited by the article: anthropic.com/research/discovering-vulnerabilities-with-claude
No source givenFirst, only or fastest
No other exploit for CVE-2026-98432 is known to have been generated or published at the time of writing.
The article gives no link or citation for it.
The article says “At the time of writing, no other exploit is known to have been generated or published”
The source says No source to compare with.
Couldn’t checkNumber
Ubuntu Pro offers coverage for up to 15 years and is free for up to 5 machines, or up to 50 for community members.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members”
The source says No passage could be compared.
Source cited by the article: ubuntu.com/pro
Also covered by
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 4 Nov 2026, 05:47 UTC. It played no part in the ranking.