Canonical has left an unpatched Ubuntu kernel zero-day open across three Long Term Support releases for almost three weeks, leaving production servers vulnerable to remote code execution. The security flaw carries a critical Common Vulnerability Scoring System rating of 9.8, yet the distributor has not published official kernel updates or an estimated arrival date for fixes.
Key points
- A critical remote code execution flaw, tracked as CVE-2026-98432, carries a CVSS score of 9.8.
- Official kernel packages for Ubuntu 22.04, 24.04, and 26.04 LTS remain unfixed nearly three weeks after discovery.
- The delay affects internet-facing infrastructure and multi-tenant hosts that rely on base operating system isolation.
- Canonical has not announced a timetable for patched kernel builds.
Which systems are exposed
The unpatched vulnerability affects the Linux kernel packages distributed across Ubuntu’s primary server releases: version 22.04, version 24.04, and version 26.04 LTS. Security trackers catalogued the flaw as CVE-2026-98432, assigning it a severity score of 9.8 out of 10.
A score of 9.8 reflects a flaw that attackers can trigger over a network without authentication or user interaction. In practical terms, an attacker who reaches an exposed port or triggers the affected kernel path can execute arbitrary code with operating system supervisor privileges.
Because the vulnerability sits inside the core kernel rather than in an isolated user-space daemon, standard access controls offer little protection once an exploit succeeds.
Why the patch delay matters
Long Term Support releases form the backbone of modern enterprise server deployments. Engineering teams select Ubuntu LTS precisely because Canonical guarantees stable interfaces and rapid security maintenance across multi-year cycles.
The three-week delay creates operational problems for administrators managing public infrastructure. Internet-facing hosts and multi-tenant hypervisors rely directly on the kernel to enforce boundary separation between containers and host services. When those boundaries break down, unprivileged tenants or remote scanners can gain complete machine access.
Infrastructure compromises can lead to prolonged operational recovery. Similar threats recently forced teams to rebuild core infrastructure from scratch, as seen when the Alpine Linux GitLab server was rebuilt after an attack compromised administrative trust.
How administrators can manage the gap
Without signed distribution packages from Canonical, system administrators face difficult operational trade-offs. The primary options depend on individual risk tolerance and internal deployment pipelines.
Administrators can maintain stock kernels and restrict network exposure. Teams take this route by using external firewalls, host-based filtering, and private network overlays to prevent untrusted traffic from reaching affected machines.
Other teams are compiling out-of-tree patches directly from upstream kernel sources or switching sensitive workloads to alternative distributions that have already published fixed kernel packages. Moving to bespoke kernels, however, risks breaking proprietary kernel modules and automated hardware management scripts.
Maintaining custom patches also increases maintenance overhead. Large organisations often struggle with patch quality control, an area under scrutiny as the Linux kernel AI code vetting model attempts to reduce regressions during upstream patch submission.
What happens next
Canonical has not posted a public timeline for when updated kernel images will reach the main package repositories. The company typically distributes security remediations through its Ubuntu Security Notices platform before packages filter down to automated update mirrors.
Until Canonical issues official update notices, operators running Ubuntu 22.04, 24.04, or 26.04 LTS must monitor their package managers manually and decide whether temporary network isolation provides adequate cover.
