Ubuntu has published a status post on CVE-2026-98432, the kernel flaw we covered on 30 October: the fix exists for current releases but has not reached the security updates pocket.

What is where

“The fixes are currently in the -proposed pocket”, Ubuntu says, for 22.04 LTS and newer, while it tests them. On 26.10 the fix has landed: the table lists “Fixed in 7.3.0-10.10”. For 22.04 LTS the -proposed package is 5.15.0-203.213, for 24.04 LTS it is 6.8.0-149.149, and for 26.04 it is 7.0.0-43.43. Xenial, Bionic and Focal, meaning 16.04, 18.04 and 20.04, show “Fix pending”, and 14.04 is listed as not affected.

The support detail that governs who can act: “Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support”, while “If you are using Ubuntu 20.04 LTS or older, the Ubuntu Pro subscription offers coverage for up to 15 years.”

Ubuntu explains the wait: it tests across “more than 2,000 certified servers and devices” and “will release the fixes in the updates pocket of the Ubuntu archive as soon as those tests are complete”.

The MPTCP point

Our earlier piece described the flaw through the multipath TCP path, following Anthropic’s write-up. Ubuntu pushes back on the workaround that framing invites: “Mitigations that disable multipath TCP (MPTCP) are being recommended by various sources, but please note that the CVE fix is not specific to MPTCP.”

Turning MPTCP off may reduce exposure along one path, but it is not the patch, and a host with MPTCP disabled still waits for the kernel fix.

The documented path to -proposed

Ubuntu documents the opt-in route, and these are its commands rather than a reconstruction. Check what you are running first:

uname -r
dpkg -l 'linux-image*' | grep ^ii

Then enable the pocket:

sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu

Update and install the kernel packages from -proposed explicitly:

sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade

Then reboot:

sudo reboot

The post explains why the long install line is needed: “Packages from the -proposed pocket are not selected for upgrade by default.” You have to ask for that pocket by name, -proposed is where Ubuntu stages fixes it is still testing, and the reboot is part of the change.

Severity, reported two ways

The post rates this at “a CVSS 3.1 score of 9.8, corresponding to a severity of High”, which is Ubuntu’s own scale. NVD’s record for the same identifier carries 9.8 and labels it critical, in a secondary metric from the kernel CNA, with the record’s status still showing as received. Both numbers are the same; the words attached to them are not, and which you quote depends on whose scale you read.

What to do

On 26.10 there is nothing to wait for. On 22.04, 24.04 and 26.04 the fix exists in -proposed if you can tolerate a testing pocket; otherwise take the kernel update when it reaches the updates pocket. On 20.04 and older, the documented route is Ubuntu Pro. If you mitigated by disabling MPTCP, you have reduced one path and patched nothing.