The short version: Canonical has published kernel fixes for CVE-2026-98432, a 9.8-rated bug in the kernel’s IPv4 TCP handling that can give a remote attacker root. On Saturday 14 November the Ubuntu security tracker listed fixed kernels for 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS. 20.04, 18.04 and 16.04 are still marked vulnerable, with work in progress. The same day brought the first Ubuntu 27.04 daily images, a Plasma change that stops XWayland running when nothing needs it, and a new non-profit home for Manjaro.
The kernel bug Ubuntu just fixed
CVE-2026-98432 is a use-after-free in the kernel’s IPv4 TCP connection handling. A retransmitted SYN can be processed while a child socket is being torn down, so ip_options_build() reads memory that has already been freed.
Canonical rates it Critical, with a CVSS score of 9.8, and it can be triggered over the network without logging in. On 27 October, Anthropic’s Frontier Red Team reported that one of its research models had written an exploit that ran a command as root on a server with a Multipath TCP listener. A failed attempt only drops the handshake instead of crashing the machine, so an attacker can keep trying. The Cloud Security Alliance note has the full timeline.
According to the Ubuntu security tracker, these are the fixed kernel versions as of 14 November:
| Ubuntu release | Fixed kernel |
|---|---|
| 26.10 | 7.3.0-10.10 |
| 26.04 LTS | 7.0.0-43.43 |
| 24.04 LTS | 6.8.0-149.149 |
| 22.04 LTS | 5.15.0-203.213 |
| 20.04, 18.04, 16.04 | Vulnerable, work in progress |
On 14.04, the standard kernel is listed as not affected. If you are on 20.04 or one of the older LTS releases, the fix is not there yet, and those machines are only covered by Ubuntu Pro now. Our CVE-2026-98432 fix guide covers checking your kernel in more detail.
Ubuntu 27.04 daily images are available
The tenacious folder on cdimage.ubuntu.com was populated on 14 November, which means the first Ubuntu 27.04 daily builds are public. The current desktop image is tenacious-desktop-amd64v3.iso, 5.9 GB, built for x86-64-v3 processors.
That v3 requirement is not cosmetic. It needs AVX, AVX2, BMI1, BMI2, F16C, FMA, LZCNT, MOVBE and XSAVE support, so older CPUs cannot boot it. These are daily builds: expect breakage, file bugs, and keep them off any machine you rely on. The final release is planned for 22 April 2027, and our Ubuntu 27.04 release schedule lists the milestones in between.
Plasma 6.9 stops XWayland running in the background
KDE’s weekly update says XWayland is now loaded only when an application needs it. Until now Plasma kept the X11 compatibility layer running for the whole session, even with no X11 apps open. The change comes from Vlad Zahorodnii, David Edmundson and David Redondo, and it ships in Plasma 6.9.
The same cycle brings a QML rewrite of the Task Switching settings page, a single-page Date and Time panel, and more icon sizes for Folder View. Separately, KDE has released Frameworks 6.32, the library set under Plasma and KDE apps.
Manjaro now has its own non-profit
The Manjaro Project e.V. is officially registered as a non-profit in Germany and is legally separate from Manjaro GmbH and Co. KG. The founders are Dennis ten Hoove, Frank Vandermeiren, Jonas Strassel, Mark Wagie, Roman Gilg, Simon Büeler and Stefano Capitani, according to the announcement on the Manjaro forum.
The post also says the team is rebuilding development infrastructure after bot attacks, and that recent stable and testing updates were published without oversight from founder Philip Müller. For users, the practical question is whether releases keep arriving on time. The new association is a structure for that, not a guarantee.
How to get the kernel fix on Ubuntu
Update, then reboot into the new kernel. The old one stays in memory until you do.
sudo apt update
sudo apt full-upgrade
sudo rebootAfter the restart, check what you are running and compare it with the table above:
uname -rIf the version is older than the one listed for your release, run sudo apt update again and check that the security pocket is enabled. On 20.04, 18.04 or 16.04, confirm on the tracker whether a fix has landed before you plan a reboot.
Sources: the Ubuntu CVE-2026-98432 tracker, Ubuntu 27.04 daily images on cdimage, This Week in Plasma, the Frameworks 6.32 announcement and the Manjaro Project e.V. post.
