Ubuntu’s TCP vulnerability tracker requires a package-specific check

Ubuntu’s tracker for CVE-2026-98432 lists multiple kernel packages as vulnerable, with fixes marked as work in progress for several supported releases. The bug involves TCP code reading memory that another processor can free. Operators need to check their actual kernel package and release: a proposed fix version is not the same as an available security update.

Ubuntu Security · Oct 15, 2026

Why it matters

Distribution and kernel-package status determines whether an upstream fix has reached a particular server.

More context

The official record was published October 15 and last updated October 30. It documents the ownership race and the change to defer freeing memory until readers finish. Check the live package table and normal distribution update guidance before deciding the next operational step.

Keep in mind

Tracker status can change. This card does not verify a particular machine’s exposure, demonstrate exploitation or establish that every Linux kernel package is affected.

Original read