As of 3 November, patched kernels for CVE-2026-98432 are in testing for Ubuntu 22.04, 24.04 and 26.04 LTS, but are yet to hit the stable updates pocket. Canonical hasn’t given a date for when it expects them to.

...

The CVE involved a type of bug known as a use-after-free. It affects the part of the Linux kernel that handles incoming network connections, specifically the TCP handshake over IPv4.

...

A lackadaisical approach to security is uncharacteristic of Canonical, a company that makes it money selling support to enterprises, businesses and cloud on the basis of “timely security updates” via Ubuntu Pro, ESM and other packages.

Canonical says it tests kernels on thousands of certified servers and devices before it releases anything, and says that admins can, if they wish, enable and install the -proposed update pocket to be patched sooner.

It also dismissed disabling MPTCP as a workaround, saying security updates are “the only appropriate mitigation” since the bug isn’t specific to that feature.

Oddly, it’s may company’s new kernel security cadence, introduced to get security fixes out to users, faster, that appears to be the cause of the delay. With kernel goes through a fixed testing period, the fixes come as fast as they can.

But not, it may seem, fast enough.

A Canonical engineer has published a prototype launcher that simulates how on-device AI could be used to enhance and aid users of the Ubuntu desktop.

But the warty-prototype1 snap by Didier Roche-Tolomelli (aka didrocks) is not a real launcher. It’s a semi-interactive, automated mockup. It simulates things a user could do, and that includes interacting with a (theoretical) on-device AI model to complete tasks.

Those trying to access the Ubuntu website, ISO downloads, and similar Ubuntu resources today are finding the site inoperable amid what's now confirmed as an ongoing distributed denial of service attack