Ubuntu Still Hasn't Fully Patched This Exploit

Summary

The video examines CVE-2026-98432, a critical Linux kernel vulnerability in the IPv4 TCP networking code. The flaw is described as a use-after-free race condition involving connection data and IPv4 header options: one CPU core may free memory while another is still using it.

An attacker who wins the timing race could first leak a kernel memory address and then execute code as root, potentially gaining full control of an affected server. The vulnerability reportedly dates back to kernel 4.4, released in 2016, and is rated 9.8/10.

Exploitation and Potential Impact

The narrator says Anthropic researchers demonstrated the exploit in a lab, taking about 48 minutes to leak the address and another five minutes to obtain root access. Exploitation requires specially crafted IPv4 TCP packets and precise timing, and some network configurations may filter the relevant packets. Failed attempts can reportedly be retried.

The video also reports mass scanning for vulnerable servers and cites a researcher’s estimate that more than two million may remain exposed. Potential impacts include data theft, website tampering, malware installation, and risks to other machines reachable from a compromised server.

Ubuntu’s Patch Rollout

The video focuses on Ubuntu’s patch rollout and communication:

• Debian, Arch, and Alpine had released fixes before the video’s stated date of November 7. The narrator says most Ubuntu LTS releases were still marked as awaiting fixes, including for Ubuntu Pro subscribers.
• Canonical said it was testing fixes across more than 2,000 certified servers and devices to preserve stability. The narrator explains that Ubuntu’s kernel modifications may require fixes to be backported and tested separately for individual releases.
• The video highlights conflicting information: Ubuntu’s CVE page reportedly marked only the newest non-LTS release as fully patched, while kernel updates for Resolute and Noble were already available through normal updates. Jammy’s fix was in the proposed packages branch, which the narrator advises testing before production use. A reboot is needed to apply an updated kernel.
• The narrator criticizes both the delay and the mismatch between the CVE status page and available update packages, arguing that this undermines confidence in Ubuntu’s security response.

Review and Sources

This is a security analysis, not a product review or step-by-step tutorial. It explains the vulnerability, its possible impact, and how Ubuntu’s patch status differs across releases.

The video is narrated by Mental Outlaw and refers to information from Canonical/Ubuntu’s CVE and update pages, AWS, Anthropic researchers, and a researcher who reported the mass scanning.