A developer takes his Ubuntu servers offline because Ubuntu had not shipped a fix for a critical Linux TCP flaw
A short, angry post that sparked a big debate about what 'timely patches' means; the Atlas advisory lays out which distributions had fixes and when.
In a November 2 post, the developer behind chalmovsky.com writes that he took all his Ubuntu servers offline and is moving them to another distribution. His complaint: CVE-2026-98432, a critical (CVSS 9.8) remotely reachable use-after-free in the Linux kernel's TCP code, had been patched by Debian on October 16, and Anthropic says it built a working root exploit, yet more than two weeks later every supported Ubuntu release, LTS included, was listed as vulnerable. He contrasts this with Ubuntu's promise of "timely patches for critical vulnerabilities" and with volunteer-run distributions (Debian, Arch, Alpine) that had shipped the fix.
Atlas's advisory, updated November 5, says Red Hat shipped fixed kernels on November 1 and AlmaLinux on November 2, while Ubuntu had a fixed kernel only for 26.10 and its fixes for 22.04, 24.04 and 26.04 were still in testing. Ubuntu's CVE page rates the bug Critical and offers an interim packet-filtering mitigation.
-
Long-term support
After exploring W*F Ubuntu?, for what an LTS release is supposed to promise, read about Long-term support.
Explains the product lifecycle policy under which a stable release, such as an Ubuntu LTS, is maintained for longer than the standard edition.
Wikipedia · Wade · 5 min
0 -
Multipath TCP
After exploring Linux's October 2026 TCP Use-After-Free: CVE-2026-98432 — Atlas, the feature the root exploit relies on is explained in Multipath TCP.
Multipath TCP is an IETF effort to let a single TCP connection use several network paths at once for more throughput and redundancy.
Wikipedia · Wade · 5 min
0