Canonical's CVE Response Times

CVE-2026-98432 was first published on October 15th, thanks to Linux's cautious CVE policy. On October 24th, after a blog post by Anthropic, it had a CVSS score of 9.8 assigned.

Since this was a critical vulnerability, patches and advisories followed quickly:

• Debian 12 was patched on the 17th (before the CVSS score was revised), while 13 was patched on the 2nd November.
• Red Hat patched RHEL8-10 on the 1st November.
• SUSE had the fix in Leap on the 25th, and on other branches no later than the 29th.

Except for Ubuntu.

At time of writing (3rd November), Canonical does not have a fix in their main repositories. This morning, they released a fix to the proposed pocket, for some of their distributions, for "users who run their own kernel acceptance tests".

Their blog post also takes the time to remind the reader that if you paid for Ubuntu Pro, you can get security updates for their older LTS branches for longer. This is a strange thing to point out when all of the versions that you can pay them for don't actually have this security patch yet (not even in a proposed pocket).

For now, I guess RedHat's nftables mitigation will have to do. For the future, the reasons to choose Ubuntu over Debian are only growing weaker (at least on the server side). At least, if you're not paying for pro.