WTF Ubuntu?

Canonical's Ubuntu has yet to patch CVE-2026-98432, a critical (CVSS 9.8) flaw in the Linux kernel's TCP code that has existed since 2016 and affects virtually every Linux server worldwide, more than two weeks after Debian shipped its fix on October 16. Anthropic says it built a working exploit that grants root—full server takeover—remotely, raising the stakes for the unpatched window. The vulnerability affects every supported Ubuntu release, including LTS versions, despite Canonical selling security subscriptions and marketing "timely patches for critical vulnerabilities." Volunteer-run distributions including Debian, Arch, and Alpine have all shipped fixes, intensifying criticism of the commercial vendor's response. The author reports taking Ubuntu servers offline and migrating off the platform entirely. Watch for Ubuntu's patch release timing and any evidence of active exploitation in the wild.