The short version: you do not have to wait for the normal Ubuntu updates channel to patch CVE-2026-98432. Canonical has published fixed kernels for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS in the -proposed pocket, and Ubuntu 26.10 already carries the fix in its regular kernel. Here is Canonical’s side of the delay, and the exact steps to install the fix now.
What users are asking Canonical
A critical wait: CVE-2026-98432 is a use-after-free in IPv4 TCP connection handling in Linux kernel 4.4 and later. Ubuntu rates it Critical with a CVSS 3.1 score of 9.8. Debian and several other distributions shipped fixes weeks earlier, so some Ubuntu users have been asking why their LTS kernels are still waiting in the normal updates channel.
That pressure is fair: if you run an internet-facing Ubuntu host, waiting weeks for a Critical kernel fix is uncomfortable. The good news Canonical published on 2 November 2026 is that the fix is already packaged for the supported LTS releases. It is just sitting in a different archive pocket while qualification finishes.
Canonical’s side of the delay
SRU testing is the bottleneck: in its official blog post, Canonical says the team is testing the CVE-2026-98432 fixes for Ubuntu 22.04 LTS and newer. The builds live in the -proposed pocket so administrators who run their own kernel acceptance tests can opt in early, under Canonical’s newer SRU strategy for speeding up CVE fixes.
Why that takes time: Canonical says it runs extensive tests on more than 2,000 certified servers and devices before moving a kernel into the updates pocket. That is the usual Stable Release Update (SRU) cycle for Ubuntu kernels. It protects a huge hardware matrix, but it also means a Critical CVE can sit in -proposed while those tests complete. Canonical has not published a calendar date for when these builds will leave -proposed.
What Canonical rejects as a workaround: some outside advice suggests disabling Multipath TCP (MPTCP). Canonical’s Ubuntu Security Team says the vulnerability is not specific to MPTCP, and that security updates are the only appropriate mitigation. An nftables rule that drops incoming IPv4 TCP packets with IP options can reduce risk, but Canonical presents it as a limit, not a full fix.
The solution: get the fixed kernel now
You have two clean options today:
- Ubuntu 26.10: the fixed generic kernel is already listed as
7.3.0-10.10. A normalsudo apt update && sudo apt full-upgradeand reboot should get you there if you are still on an older 7.3 build. - Ubuntu 22.04, 24.04 and 26.04 LTS: enable the -proposed pocket for the main component, install the linux meta-package upgrade from -proposed, then reboot.
Fixed generic kernel versions Canonical lists:
| Release | Status | Fixed generic kernel |
|---|---|---|
| Ubuntu 26.10 Stonking |
Fixed in updates | 7.3.0-10.10 |
| Ubuntu 26.04 LTS Resolute |
In -proposed | 7.0.0-43.43 |
| Ubuntu 24.04 LTS Noble |
In -proposed | 6.8.0-149.149 |
| Ubuntu 22.04 LTS Jammy |
In -proposed | 5.15.0-203.213 |
HWE and other flavours: cloud, HWE, lowlatency and FIPS kernels have separate tracker rows. On Ubuntu 24.04, the 7.0 HWE line is tracked against 7.0.0-43.43~24.04.1. Match the flavour you actually run before you treat a host as patched.
How to install the -proposed kernel
1. See what you are running:
2. Enable -proposed for the main component only (this covers the Linux kernel images without flipping every package on your system to -proposed):
3. Refresh the package lists and upgrade the linux meta-packages from -proposed:
4. Reboot into the new kernel and confirm:
About -proposed: packages there are not selected for upgrade by default. You have to ask for them with -t CODENAME-proposed. That is intentional. Canonical treats -proposed as a qualification channel, not as automatic security delivery for every desktop.
Who should wait instead?
If you prefer the normal path: leave -proposed alone and keep applying regular updates. Canonical says the same builds will move into the updates pocket once testing finishes. Desktops that are not exposed to untrusted networks may reasonably wait. Internet-facing servers, VPN gateways and anything that accepts inbound TCP are the machines where installing from -proposed now makes the most sense.
Older releases: Ubuntu 20.04 LTS and older are still listed as pending on the generic linux package. Canonical says fixes for older still-supported releases will follow, and Ubuntu Pro covers Expanded Security Maintenance for those LTS lines.
Need the full background? Our first write-up covers the vulnerability itself, the Anthropic research context and the status table in more detail: Critical Kernel Flaw CVE-2026-98432: How to Patch Ubuntu.
Source: Canonical: Fixes available in -proposed pocket for CVE-2026-98432.
