Post by @nixCraft@mastodon.social

2026-11-02 15:28 UTC

WTF Ubuntu? https://chalmovsky.com/posts/wtf-ubuntu In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover. Debian patched it on October 16. Ubuntu still doesn't have a patch more than two weeks later. Every supported release, LTS included, is listed as "Vulnerable".

Replies (13)

@rzeta0@mastodon.world 2026-11-02 15:34

@nixCraft@mastodon.social people should be asking what they get for that "security subscription"

Open ##5468315
@troed@swecyb.com 2026-11-02 15:50

@nixCraft@mastodon.social It seems even harder to exploit than the PHP issue though.

Open ##5468392
@castrillo@mastodon.online 2026-11-02 15:51

@nixCraft@mastodon.social hello chatblabla can you patch my mind thx 🐖🐧💻 what a wild week my ops teams becomes officially the patching emergency team 🚁🚁🚁🚁🚁🚁🚁🚁

Open ##5468398
@BenAveling@mastodon.ie 2026-11-02 16:07

How do they get 9.8 out of that? As described, this isn't even simple to DoS, let alone to RCE. Is there more that they're not telling us? @nixCraft@mastodon.social

Open ##5468458
@giggls@karlsruhe-social.de 2026-11-02 16:11

@nixCraft@mastodon.social Could a "frankenkernel" be the Problem? Debian Kernel ist mostly Mainline. https://karlsruhe-social.de/@corbet@social.kernel.org/117532142736691165

Open ##5468474
@technoshythecodefox@mastodon.social 2026-11-02 16:30

@nixCraft@mastodon.social I don’t use Ubuntu anymore

Open ##5468542
@Kerplunk@mastodon.scot 2026-11-02 17:23

@nixCraft@mastodon.social Ubuntu, IMHO an awful choice. the fact that below CVE is not fixed despite the fact it is patched by Debian is yet another reason to install a decent distribution. CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code.

Open ##5468756
@slyecho@mdon.ee 2026-11-02 19:09

@nixCraft@mastodon.social One can use Red Hat's suggested nft rules to patch the hole: https://access.redhat.com/security/vulnerabilities/RHSB-2026-016

Open ##5469152
@lihongqian@mastodon.social 2026-11-02 19:44

https://liz.yoock.com That's very well said I hope everyone can learn more tips on how to prevent fraud!

Open ##5469277
@noodle@aus.social 2026-11-02 20:22

@nixCraft@mastodon.social Lies, damn lies, and modern CVE scores.

Open ##5469426
@zl2tod@mastodon.online 2026-11-03 00:36

@nixCraft@mastodon.social And to add to the misery there were a shit-tonne of patched CVEs in the kernel that landed in Debian stable this morning.

Open ##5470322
@sgsax@mastodon.social 2026-11-03 01:08

@nixCraft@mastodon.social Fwiw, RHEL just released a patched kernel yesterday. Ubuntu isn't the only slow kid on the block, though they might end up being the slowest.

Open ##5470400
@jasondecordoba@mastodon.social 2026-11-03 06:46

@nixCraft@mastodon.social Why @FreeBSD

Open ##5471303