Canonical has made security fixes for CVE-2026-98432 available in Ubuntu's -proposed software repository for testing, as it works towards releasing the patches through standard security updates.
The vulnerability affects the Linux kernel and has raised concerns because successful exploitation could allow attackers to gain root-level privileges on vulnerable systems.
What Is CVE-2026-98432?
CVE-2026-98432 is a critical Linux kernel vulnerability involving Multipath TCP (MPTCP).
The flaw is associated with a use-after-free memory management issue. Under certain conditions, an attacker could exploit the vulnerability to execute code with elevated privileges.
Security researchers have reported a severity rating of 9.8 on the CVSS scale, highlighting the potential impact on affected systems.
Ubuntu Security Fixes Are Under Testing
In an update published on 2 November 2026, Canonical confirmed that fixes for Ubuntu 22.04 LTS and newer releases are undergoing testing.
The patches are currently available through the -proposed pocket, an Ubuntu repository used to test updates before they are promoted to the standard updates repository.
Canonical says its testing process covers more than 2,000 certified servers and devices to help ensure that the updates do not introduce compatibility or stability problems.
The company has indicated that the fixes will move into the updates pocket once testing is complete.
Older supported Ubuntu releases are expected to receive fixes separately.
Which Ubuntu Versions Are Affected?
Canonical's published update identifies the following release groups:
- Ubuntu 26.10: A fix is listed in the release information, although the security tracker has shown a differing status.
- Ubuntu 26.04 LTS: Fix available in
-proposed. - Ubuntu 24.04 LTS: Fix available in
-proposed. - Ubuntu 22.04 LTS: Fix available in
-proposed. - Ubuntu 20.04, 18.04 and 16.04: Fixes pending, with older releases covered through applicable Ubuntu Pro support arrangements.
Administrators should check the current Ubuntu Security Tracker and package status for their specific release before taking action.
What Should Ubuntu Administrators Do?
System administrators should identify whether their servers are running affected kernel versions and monitor Canonical's security announcements for the official update.
The -proposed repository is intended for testing. It should not be treated as a normal production update source. Administrators who operate their own kernel acceptance testing environments can evaluate the proposed packages before wider deployment.
Canonical has stated that security updates are the appropriate mitigation for this vulnerability.
Organisations should also maintain current backups, monitor privileged system activity and follow established patch-management procedures.
Why This Update Matters
Kernel vulnerabilities can affect the security of an entire operating system, making them particularly important for organisations running production servers, cloud infrastructure and business-critical applications.
The CVE-2026-98432 situation highlights the importance of timely security updates and thorough testing before deploying kernel patches across production environments.
Ubuntu administrators should continue monitoring official security notices and apply the appropriate fixes once they are released for their systems.
