Canonical says its fixes for CVE-2026-98432, the Linux kernel flaw Anthropic says its unreleased model turned into a remote root exploit, are still in testing for Ubuntu 22.04 LTS and newer. That is 18 days after Debian shipped its first fix on 16 October, by our arithmetic. In a blog post dated 2 November, Canonical says the fixes sit in the -proposed pocket while it runs tests “on more than 2,000 certified servers and devices”.
Ubuntu’s own tracker, read at 03:30 UTC on 3 November, still lists the linux package as “Vulnerable” on 7 of the 8 releases it tracks, from 26.10 back to 16.04. Canonical’s post came on the day a blog post attacking Ubuntu’s delay drew 1,365 points and 591 comments on Hacker News, as of our check at 03:34 UTC.
Business Pill · Distribution Advantage
A short Business Engineer explainer on distribution advantage: why reach decides which product gets tried. It teaches the general idea only and says nothing about Ubuntu, Canonical or this vulnerability.
The key insight: As we read it, the delay sits in Canonical’s own release step: Launchpad shows Ubuntu’s 24.04 and 22.04 LTS kernel builds in -proposed since 26 October, while Canonical says it is testing them on more than 2,000 certified servers and devices before release, 18 days after Debian’s first fix by our arithmetic.
The post, by Luci Stanescu, says: “Our team is currently working on testing the fixes for CVE-2026-98432 for Ubuntu 22.04 LTS and newer”. Users who run their own kernel acceptance tests can apply the -proposed builds now, it says, and “A fix for older, still supported Ubuntu releases will follow”.
Canonical says it will release the fixes in the updates pocket “as soon as those tests are complete”. The post gives no date. Its table lists 26.10 as fixed in 7.3.0-10.10; 26.04, 24.04 and 22.04 LTS with a fix available in -proposed; and 20.04, 18.04 and 16.04 with a fix pending.
On workarounds, the post notes that disabling multipath TCP is being recommended elsewhere but says the fix is not specific to it. It adds that “no other exploit is known to have been generated or published”, and states: “The Ubuntu Security Team believes that security updates are the only appropriate mitigation”.
Fix dates for CVE-2026-98432 by distribution, from each vendorโs own pages: Debian trixie 16 Oct (DSA-6568-1) and bookworm 17 Oct (DLA-4841-1); Amazon Linux 2023 30 Oct; Red Hat RHEL 8, 9 and 10 1 Nov. Ubuntu builds for 24.04 and 22.04 LTS entered -proposed testing on 26 Oct and for 26.04 LTS on 28 Oct (Launchpad); 20.04, 18.04 and 16.04 show a fix pending (Canonical blog, 2 Nov). Canonicalโs blog lists 26.10 as fixed while its tracker, read 03:30 UTC 3 Nov, lists it as vulnerable. Day counts are our arithmetic.
How Long the Builds Have Waited
Launchpad, Ubuntu’s build service, shows the 24.04 and 22.04 kernel builds named in Canonical’s table published to -proposed on 26 October, and the 26.04 build on 28 October. That is 8 and 6 days in testing at our read time, by our arithmetic. The 26.10 build reached the updates pocket on 28 October.
The tracker and the blog disagree on 26.10: the blog lists it as fixed, while the tracker, last updated 30 October, still shows it as vulnerable with work in progress in the same 7.3.0-10.10 version. Ubuntu’s notices feed returned no Ubuntu Security Notice for the CVE when we checked, and its newest Livepatch Security Notice, LSN-0122-1, is dated 7 October.
Where Other Distributions Stand
Debian’s mailing-list archives date its trixie advisory, DSA-6568-1, to 16 October and its bookworm advisory, DLA-4841-1, to 17 October; its tracker lists both as fixing the CVE. That confirms the 16 October date we could not check in our first piece, one day after the CVE was published.
Amazon Linux lists a fixed Amazon Linux 2023 kernel on 30 October. Red Hat’s security data shows fixes for RHEL 8, 9 and 10 dated 1 November, and a fix for its NVIDIA build of RHEL 10 dated 2 November. It still lists the RHEL 9 real-time kernel and OpenShift 4 and 5 images as affected.
What Canonical Sells
Canonical sells Ubuntu Pro, which its site lists as a security and compliance subscription. Its server page says customers can “Benefit from up to 15 years of security coverage from Canonical, with timely patches for critical vulnerabilities”. Its security page says “nobody provides fixes available faster than Canonical”.
The 2 November post says 26.10, 26.04, 24.04 and 22.04 get the fixes under standard support, while 20.04 and older are covered through an Ubuntu Pro subscription. It adds that “Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members”.
In September Canonical announced “a unified, rapid 2-week SRU cycle, published weekly” for kernel updates. That post says “The recent explosion in the volume of CVEs is fueled by artificial intelligence”, and sets a goal for workarounds: “The goal is to get environments into a defensible, safer state within 24 to 48 hours of public disclosure”. Where no safe workaround exists, it says, Canonical “will say so clearly”.
The Post That Went Viral
The Hacker News thread was submitted at 14:52 UTC on 2 November, linking a post on chalmovsky.com that says it was “true as of 2026-11-02 14:48 UTC”. The author quotes Ubuntu’s “timely patches for critical vulnerabilities” line, which we found on ubuntu.com/server, and writes: “I had to take all my servers that run Ubuntu offline”.
The author also writes: “I’m moving all my servers off Ubuntu. I’ve completely lost trust in it”. That is one operator’s account and view; we did not contact the author and have no figures on how many users have changed distributions.
As we read the dates, every distribution here started from the same upstream fix: Debian listed fixes on 16 and 17 October, Amazon Linux on 30 October and Red Hat on 1 November, while Ubuntu’s LTS builds were published to -proposed on 26 and 28 October and not yet released at our read time.
As we read Canonical’s own pages, the speed of a tested fix is part of what it sells: its server page offers “timely patches for critical vulnerabilities”, and its 2 November post says releases from 20.04 back are covered through an Ubuntu Pro subscription, with that fix still pending.
Canonical, Ubuntu blog, 2 November 2026
“To ensure stability across a wide ecosystem we perform extensive tests on more than 2,000 certified servers and devices”
Three Implications
FOR UBUNTU OPERATORS Canonical says users who run their own kernel acceptance tests can apply the -proposed builds for 22.04 LTS and newer, and that the Ubuntu Security Team sees security updates as the only appropriate mitigation.
FOR UBUNTU PRO CUSTOMERS Canonical’s table lists 20.04, 18.04 and 16.04, the releases it covers through Ubuntu Pro, with a fix pending and gives no date.
FOR DISTRIBUTION VENDORS Canonical’s September post says the volume of CVEs is fueled by artificial intelligence; on this flaw, Debian listed its first fix one day after publication, by our arithmetic.
The framework reads: “Close the SCARCE layer (keep proprietary) + Open the ABUNDANT layer (commoditize)”.
As we read it, Ubuntu’s releases are the open layer, and the window between an upstream fix and a tested package, kept for up to 15 years, is the layer Canonical charges for through Ubuntu Pro. On that reading this story is about the layer Canonical sells. The framework was published in March 2026 and does not discuss Canonical or this flaw.
What Is Not Established
Canonical gives no release date for the LTS fixes, and its blog and tracker disagree on the status of 26.10. Tracker statuses can change within hours; ours is as read at 03:30 UTC on 3 November. We do not know how many servers run affected Ubuntu kernels or how many operators have installed the -proposed builds.
Anthropic’s exploit has not been released, and Canonical says no other exploit is known to have been generated or published. The day counts compare dates on each vendor’s own pages and do not measure how long each vendor had the fix before the CVE was published. This piece gives no exploit details.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Canonical says Ubuntu’s fixes for CVE-2026-98432 are in -proposed testing for 22.04 LTS and newer, with tests on more than 2,000 certified servers and devices, and that older releases will follow. At 03:30 UTC on 3 November its tracker still listed 7 of 8 releases as vulnerable, 18 days after Debian’s first fix and 2 days after Red Hat’s, by our arithmetic.
A note on sourcing. Patch statuses are as listed on the Ubuntu, Debian, Red Hat and Amazon Linux security pages and on Launchpad when read on 3 November 2026 (Ubuntu tracker at 03:30 UTC) and can change. Canonical’s statements are from its blog posts of 2 November and 23 September 2026 and its product pages. The Hacker News post is quoted as one operator’s opinion. Day counts are our arithmetic. This piece gives no exploit details.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
