Ubuntu LTS kernels still exposed to CVSS 9.8 RCE, no patch in sight

What is CVE-2026-98432 and why does CVSS 9.8 matter?

CVE-2026-98432 is a critical kernel vulnerability in Ubuntu's LTS releases, scored 9.8 out of 10 on the CVSS scale. That score is reserved for flaws that are remotely exploitable, require no authentication and can lead to full system compromise.

The number is the story here. A 9.8 on CVSS is about as bad as it gets without being a full 10. It means an attacker can typically trigger the bug over the network, without credentials, and potentially execute code with kernel-level privileges. On a multi-tenant host, that is the difference between one compromised container and the whole machine.

Ubuntu 22.04, 24.04 and 26.04 LTS are all affected. These are not niche releases: 22.04 and 24.04 are the default choice for a huge share of self-hosted servers, CI runners and cloud instances. If you run Ubuntu LTS in production, this one is aimed at you.

No patch, no ETA, and no good options

Canonical has not published fixed kernel packages for any of the three LTS releases, and it has not said when they will arrive.

That silence is the part that should worry admins most. Kernel updates usually land within days for critical flaws. Nearly three weeks without a package suggests either the fix is unusually complex or the triage is still in progress. Either way, the practical result is the same: there is no official kernel you can install today that closes the hole.

The interim choices are all uncomfortable. You can stay on the stock kernel and accept the risk, hunt for an out-of-tree mitigation if one exists, or move workloads to a release or distribution that already carries the patch. None of those is a clean answer for a production fleet.

• Stay on the stock kernel and accept the exposure.
• Apply an out-of-tree mitigation if one is available for your workload.
• Migrate affected workloads to a release or kernel that already carries the fix.
• Restrict network access to sensitive hosts as a stopgap.

Who is actually exposed?

The risk is highest for internet-facing and multi-tenant self-hosted systems where the kernel enforces isolation and privilege boundaries.

A laptop running Ubuntu is not the main concern, though it is not immune. The real danger is the server sitting on a public IP, the Kubernetes node hosting other people's containers, the CI box that runs untrusted code. Those are the systems where a kernel flaw turns into a lateral-movement playground.

If you are on a managed cloud provider, check whether your host kernel is patched at the hypervisor level. Many providers handle this for you. If you are self-hosting on bare metal or managing your own VMs, the responsibility is yours, and right now there is no upstream fix to apply.

What it means for you

If you run Ubuntu 22.04, 24.04 or 26.04 LTS on any internet-facing or multi-tenant system in the US, UK or EU, you are affected until Canonical ships a patched kernel. There is no official workaround yet. Check the Ubuntu security notices page for your release and watch for a kernel update in the coming days.

Managed hosting customers should ask their provider whether the host kernel is patched independently of the guest OS. For self-hosted fleets, the safest interim step is to tighten network exposure and limit who can reach the affected hosts.

Until Canonical publishes patched kernels, the ball is in admins' courts. Check your exposure, limit network access to the hosts that matter, and keep an eye on Ubuntu's security notices. The fix will come; the question is how much damage happens before it does.