Ubuntu LTS kernels still unfixed for critical CVE-2026-98432

Ubuntu has not shipped fixed kernels for CVE-2026-98432, a critical vulnerability scored CVSS 9.8, leaving the 22.04, 24.04, and 26.04 LTS releases without a vendor update.

Operators running those releases therefore have no official kernel package that closes the hole. The gap matters most for internet-facing and multi-tenant self-hosted systems that rely on Ubuntu’s LTS kernels for isolation and privilege boundaries; until packages appear, those hosts remain exposed to whatever remote or local attack the CVE enables.

Ubuntu has not announced an ETA for the fixes. In the interim, affected administrators are left to decide whether to stay on the stock kernel, apply out-of-tree mitigations if any exist, or move workloads onto releases or kernels that already carry the patch.