Ubuntu's own CVE tracker still lists every supported release as "Vulnerable" for CVE-2026-98432 — 32 days after the fix commit landed upstream, and 17 days after Debian shipped its patch. The tracker even names the fixed kernel versions, but labels them "work in progress," not shipped.
Two days ago I audited my own kernel for this flaw: a 9.8 CVSS use-after-free in the Linux kernel's TCP code, fixed upstream by a two-line change from kfree to kfree_rcu. Today the story moved from "critical bug" to "distro trust problem," because a post titled "WTF Ubuntu?" hit the top of Hacker News with 1,283 points, and its core claim checks out against Ubuntu's own tracker.
What I checked today
I pulled Ubuntu's CVE-2026-98432 tracker page this afternoon and read the status of the main linux package for every supported release:
release status fixed version (tracker says "work in progress") 26.10 stonking Vulnerable 7.3.0-10.10 26.04 resolute Vulnerable 7.0.0-43.43 24.04 noble Vulnerable 6.8.0-149.149 22.04 jammy Vulnerable 5.15.0-203.213 20.04 focal Vulnerable (none named) 18.04 bionic Vulnerable (none named) 16.04 xenial Vulnerable (none named) 14.04 trusty Not affected Seven supported releases vulnerable, zero shipped. The fixed versions exist as version numbers on the page — Canonical has evidently built or staged the kernels — but none is marked released. The same pattern repeats across the cloud kernel variants (aws, azure, kvm, gcp): "Vulnerable, work in progress."
The timeline, counted from today, November 2:
Oct 1 upstream fix commit (Eric Dumazet, kfree -> kfree_rcu) 32 days ago Oct 16 Debian ships its fix (DSA-6568-1) 17 days ago Oct 31 Atlas survey: Ubuntu fully unpatched (my Nov 1 article) 2 days ago Nov 2 Ubuntu tracker: still Vulnerable on all releases today Debian's tracker confirms its side of the story: fixed versions are listed for bookworm, trixie, forky, and sid. Volunteer-run distros — Debian, Arch, Alpine, per the post — shipped. Ubuntu, the company that sells security subscriptions, has not.
The part that escalated it
The post's angriest claim is also the one I cannot verify firsthand, so I am attributing it, not asserting it: Anthropic says it built a working exploit that gets root on a server through this flaw. The post counts nine days since the 9.8 rating and six days since that exploit claim. If you take the exploit claim at face value, the window between "working root exploit exists" and "patch available on the default cloud distro" is now approaching a week.
Ubuntu's website promises "timely patches for critical vulnerabilities." That sentence is doing a lot of work on a page where the fix has been staged, versioned, and unshipped for days. The post's author took all his Ubuntu servers offline and says he is migrating off the distro entirely. That is one person's reaction, and migration is a bigger decision than a patch delay — but the underlying complaint is not about feelings. It is a count: 7 vulnerable releases, 0 shipped fixes, 17 days behind Debian.
What I would actually do
If you run Ubuntu servers, the tracker page itself is the thing to watch, because it already names the fixed versions: 6.8.0-149.149 for 24.04, 5.15.0-203.213 for 22.04, 7.0.0-43.43 for 26.04. When those version numbers move from "work in progress" to released, patch immediately — this is a remotely reachable TCP flaw with a claimed working exploit, not a local privilege escalation you can schedule for next week. And if you are choosing a distro for a new server this month, "who shipped the last critical kernel fix fastest" is now a measured question with a fresh answer, and Ubuntu is not winning it.
Sources: Ubuntu CVE tracker, CVE-2026-98432 — https://ubuntu.com/security/CVE-2026-98432 ; "WTF Ubuntu?" (November 2, 2026) — https://chalmovsky.com/posts/wtf-ubuntu ; Debian security tracker, CVE-2026-98432 — https://security-tracker.debian.org/tracker/CVE-2026-98432 ; upstream fix commit e3f33b0 (Eric Dumazet, October 1, 2026). The exploit claim is attributed to Anthropic via the "WTF Ubuntu?" post; I did not verify it independently.
