Fixes available in -proposed pocket for CVE-2026-98432
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Canonical has put kernel fixes for CVE-2026-98432, a critical (CVSS 9.8) IPv4 TCP flaw that can allow remote code execution, into the -proposed pocket for Ubuntu 22.04, 24.04 and 26.04, with 26.10 already fixed. Older releases remain pending, and fixes reach the updates pocket only after testing on more than 2,000 certified devices. Canonical says disabling MPTCP is not a real mitigation. A blogger notes that Debian, Red Hat and SUSE shipped fixes earlier. The Anthropic-generated exploit is unreleased, and the claims here were not independently verified.