Server operators running Ubuntu are still waiting for a fix for a critical Linux kernel flaw, even as other major distributions have shipped patched kernels. This is a 2 November update to the flaw first disclosed on 31 October, covering the split patch picture rather than a first report. The flaw, tracked as CVE-2026-98432, is a use-after-free bug in the kernel's handling of IPv4 TCP connections, present since kernel version 4.4. The Linux kernel CVE team rates it 9.8 out of 10. Anthropic reported on 27 October that a research AI model had written a working exploit that reached root control on a Linux server with an exposed Multipath TCP listener, without needing a login. The company has not released the exploit code, and no attacks in the wild had been reported as of 2 November.

A split patch picture

Red Hat released fixed kernels for Red Hat Enterprise Linux 8, 9 and 10 on 1 November, and Debian, Oracle Linux and Amazon Linux have shipped fixes for at least some releases. Ubuntu has not: its security tracker still lists the main kernel packages for Ubuntu 22.04, 24.04, 26.04 and 26.10 as vulnerable, with a fix in progress and no date given. A patched kernel only takes effect after the server is restarted, so installing the update alone is not enough.

What operators are being told to do

On 2 November, Anza, a developer for the Solana network, sent an "Action Required" alert to mainnet-beta validators, quoting Solana Foundation validator relations lead Tim Garcia. Garcia advised operators to filter traffic until a fix arrives, including blocking inbound TCP packets carrying IPv4 options, disabling Multipath TCP and disabling TCP request-socket migration.

Sources: Cryptopolitan; Rescana, 2 November 2026. Draft does not claim Ubuntu servers are being attacked.