Ubuntu

Nov 3, 2026 · Operations

Ubuntu Fixed the 9.8 CVE — So Why Can't apt Install It Yet?

Ubuntu has patched CVE-2026-98432 (CVSS 9.8) for 22.04, 24.04, and 26.04 LTS, but the fixed kernels sit in the -proposed repository awaiting a two-week certification cycle on over 2,000 devices; 26.10 already includes the fix. Disabling MPTCP is not a valid mitigation, and older releases require an Ubuntu Pro subscription. Admins can wait for updates, enable -proposed for a kernel-only upgrade, or block IP options at the firewall.