Ubuntu Fixed the 9.8 CVE — So Why Can't apt Install It Yet?

Where the Patch Lives

The fix for CVE-2026-98432 — a use-after-free in IPv4 TCP connection handling present since kernel 4.4, rated CVSS 3.1 9.8 — exists but is not in the default Ubuntu repositories. Canonical's Luci Stanescu confirmed on November 2 that the patched kernels are in the -proposed pocket.

Kernel Status by Ubuntu Release

14.04 : linux — Not affected

16.04 / 18.04 / 20.04 : linux — Fix pending

22.04 LTS : 5.15.0-203.213 — In -proposed 24.04 LTS : 6.8.0-149.149 — In -proposed 26.04 LTS : 7.0.0-43.43 — In -proposed 26.10 : 7.3.0-10.10 — Already fixed

Only 26.10 has the fix in its default kernel (7.3) because the upstream patch e3f33b0a1d89 by Eric Dumazet was merged into 7.3-rc7. The four LTS releases must wait for the -proposed packages to pass certification.

-proposed is not a release. It is a holding area for candidate packages; it is disabled by default and not selected by automatic upgrades. Running apt upgrade on 22.04 today will not change the kernel version.

Cloud kernels ( linux-aws, linux-azure, linux-gcp) have separate version numbers and remain work in progress; they will not be fixed simultaneously with the generic kernel. The tracking page still shows work in progress across the board as of the blog date, so the blog is the more current reference.

-proposed Is a Process, Not a Delay

In September Canonical merged the regular and security kernel SRU cycles into a unified two-week cadence, staggered so a kernel ships every week. Week 1: select patches, build, smoke test, push to -proposed. Week 2: certification, integration, and regression testing on over 2,000 certified servers and devices before moving to updates.

This is not foot-dragging. A 9.8 kernel regression (ZFS, NVIDIA proprietary drivers, interrupt routing on old hardware) would be another incident. Canonical trades your wait time for its release certainty.

The new policy explicitly allows impatient admins to pull from -proposed and run their own validation — but responsibility shifts with the package.

Disabling MPTCP Is Not a Mitigation

The widely circulated workaround — sysctl -w net.mptcp.enabled=0 — was rejected by Ubuntu Security Team: "Security updates are the only appropriate mitigation."

Reason: The Anthropic AI-generated exploit (not publicly released) targets an MPTCP listener, but the vulnerability resides in regular IPv4 TCP. Disabling MPTCP only breaks the known exploit chain; the underlying bug remains.

On oss-security, Rui Sousa suggested init_on_free=1 as a temporary hardening. Sultan Alsawaf (CIQ kernel team) refuted it: the remote KASLR bypass reads a live kernel pointer from a reused slab slot, not freed memory. init_on_free only zeroes freed objects, so it does not mitigate this path.

Disabling MPTCP alone is insufficient because the bug is in plain IPv4 TCP.

Dropping TCP packets with IP options at the firewall prevents the vulnerable object from being allocated, but container-to-container traffic on the same host bypasses that filter. Red Hat states no temporary measure meets its "easy to deploy, broadly applicable, stable" bar; the same holds for Ubuntu.

20.04 and Older: Fixes Only via Ubuntu Pro

The blog marks 16.04, 18.04, 20.04 as Fix pending. Standard support for 20.04 has ended; 18.04 and 16.04 are even older. Canonical places these under Ubuntu Pro: 20.04 and 18.04 via ESM, 16.04 via ESM + Legacy. The patch will not appear in apt on a machine without an active Pro subscription. Pro is free for personal use up to 5 machines (50 for community members), but must be explicitly enabled.

Three Practical Paths

Wait. Monitor USN; the unified weekly cadence means the wait should be short.

Self-service from -proposed. Enable only the kernel upgrade:

sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu
sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}
' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade
sudo reboot

The $(...) expands to jammy-proposed , noble-proposed , etc. Verify with uname -r . Do not run apt full-upgrade ; it would pull all candidate packages, increasing regression risk.

Block at the boundary. Drop inbound TCP packets with IP options (header length > 5):

sudo nft add table ip cve_2026_98432
sudo nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
sudo nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop

Normal internet traffic rarely uses IP options, so false positives are low. However, CIPSO/NetLabel networks will break, and host-local container traffic is not filtered.