Users criticize Canonical for delayed TCP vulnerability patch in Ubuntu

a yellow door with a white handle on it — Xiangkun ZHU / Unsplash

Users have expressed dissatisfaction with Canonical for not releasing a patch for the TCP vulnerability CVE-2026-98432 in Ubuntu, which has been delayed by more than two weeks. A group of Linux users began voicing their concerns after it was noted that the vulnerability, which could allow remote code execution through the INET option in the TCP protocol, poses a risk to servers directly connected to the internet.

In a peculiar turn of events, other Linux distributions have already released patches for this vulnerability. For instance, Debian, which is the upstream project of Ubuntu, issued its patch shortly after the vulnerability was disclosed. However, Ubuntu has assessed the severity of this vulnerability as high instead of critical.

A point of contention among users is the extent to which this vulnerability could lead to actual remote code execution, considering that many servers operate in cloud environments which typically block packets with the INET option set. Additionally, many services are situated behind Web Application Firewalls (WAF) or Content Delivery Networks (CDN), further reducing the risk. Furthermore, the process of exploiting this vulnerability to execute commands appears to be complex, as recent kernel versions have implemented protective features like Kernel Address Space Layout Randomization (KASLR).

The vulnerability was discovered by Claude in a yet-to-be-released version. Actual exploitation requires a two-step process: first reading data from memory and then writing a callback back into memory to execute commands.

As users continue to wait for a resolution, the scrutiny on Canonical’s response to security vulnerabilities in Ubuntu remains high.