Ubuntu is still working on an update for a critical flaw in the TCP code of the Linux kernel, its developers said after online criticism. The vulnerability, CVE-2026-98432, is a race condition in the IPv4 TCP stack that enables remote code execution. In the worst case, an attacker can fully take over Linux servers.
The flaw is rated 9.8 on the CVSS scale of 1 to 10. According to Anthropic, it has built a working exploit that uses specially crafted packets against a server with a multipath TCP listener to run arbitrary commands as root, without credentials or user interaction.
The Dutch National Cyber Security Centre (NCSC) calls the flaw notable because it can be exploited remotely without authentication. The NCSC considers large-scale abuse unlikely, given the complexity of exploitation and additional measures in known distributions.
Debian released updates on 16 October, while Ubuntu has no patches yet. A critical user article titled ‘WTF Ubuntu?’ drew more than six hundred comments on Hacker News at the time of writing. Ubuntu offers an update in its -proposed pocket for users who run their own kernel acceptance tests, but a release date for the normal patch is unknown.
If you run Ubuntu servers, follow Ubuntu’s announcements and prepare your testing so you can patch quickly once the fix lands.
Read nist.gov article for more information.
