Ubuntu LTS kernels still unpatched for CVSS 9.8 Linux RCE after nearly three weeks

Ubuntu LTS kernels remain unpatched

According to a report that surfaced on Hacker News, Ubuntu has yet to ship fixed kernel packages for CVE-2026-98432, a critical Linux kernel vulnerability rated 9.8 on the CVSS scale. As of the report's publication on October 31, nearly three weeks had passed without a vendor update, leaving three LTS releases — 22.04, 24.04 and 26.04 — with no official kernel that addresses the flaw.

The write-up describes the issue as a zero-day remote code execution bug and notes that Ubuntu has not announced an estimated delivery time for the fixes.

What is known about the flaw

The report does not identify the vulnerable kernel subsystem or spell out the exploitation path. It is explicit that the affected hosts remain open to whatever attack the CVE makes possible, without pinning down whether exploitation is remote, local or both.

For context, a 9.8 base score sits at the very top of the CVSS range. Scores that high usually reflect a flaw reachable over a network that requires no privileges and no user interaction, with severe impact on confidentiality, integrity and availability. The report does not publish the full CVSS vector string, so the precise characteristics of CVE-2026-98432 cannot be confirmed from it.

Who faces the most risk

Per the report, the exposure matters most for internet-facing hosts and for multi-tenant, self-hosted systems. Those deployments lean on Ubuntu's LTS kernels as a trust boundary: the kernel is what separates tenants from one another and from the host, so a kernel-level code execution flaw undermines the isolation such setups depend on. Until patched packages appear, every one of those machines stays in an unmitigated state unless its operator intervenes.

Interim options for administrators

The report lays out three stopgap choices for admins who cannot wait for Canonical: stay on the stock kernel and accept the risk, apply out-of-tree mitigations if any exist, or move workloads onto kernels or releases that already carry the patch. It stresses that no fixed packages are available for any of the three LTS releases and that no timeline has been given, so none of these options comes with a schedule attached.

In practice, only the third option removes the vulnerability outright, and it is also the most disruptive. Migrating workloads between kernels or distributions mid-cycle carries real operational cost, and without official guidance on workarounds, each administrator has to weigh that trade-off alone. Whether viable out-of-tree mitigations even exist for this bug is left open by the report.

Why it matters

Ubuntu's LTS releases are the default foundation for a large share of self-hosted and cloud infrastructure precisely because they promise years of maintained, promptly delivered packages. A CVSS 9.8 code execution flaw sitting unpatched across all three LTS releases named in the report, for close to three weeks, cuts against that promise — and the story's climb to Hacker News's front page suggests operators have noticed.

The episode is also a reminder of how much risk concentrates in a single vendor's patch pipeline. Until fixed kernels ship, or at minimum a timeline is communicated, the exposure of every affected host depends on individual workaround decisions rather than on the vendor's response. For teams running internet-facing or multi-tenant Ubuntu servers, checking kernel versions and preparing a migration or mitigation path now is the prudent move.