Ubuntu servers: the fix for the critical kernel flaw is out. Update and reboot.

What was announced

CVE-2026-98432 was published on October 15, 2026. It is a memory-handling error in the part of the Linux kernel that handles ordinary network connections (IPv4 TCP), and Ubuntu's security page says it can lead to remote code execution. No login is needed. Ubuntu servers waited several weeks for a fix. Ubuntu's page now lists these fixed kernels:

Ubuntu release	Fixed kernel
26.04 LTS	7.0.0-43 or later
24.04 LTS	6.8.0-149 or later
22.04 LTS	5.15.0-203 or later
20.04 LTS and older	Still in progress as of November 11

Some of the newer optional kernels (the "HWE" kernels on 22.04 and 24.04) are also still in progress. If your server uses one, check Ubuntu's page for its status.

Who this affects

Any Ubuntu server that has not been updated and rebooted since the fix was released: web servers, file servers, application and database servers, virtual machines and cloud instances alike. A server that faces the internet is the most urgent, but servers on an office network should be patched too.

What to do

1. Check the kernel the server is running. Run uname -r and compare the number with the table above. On 24.04 you want 6.8.0-149 or later; on 22.04, 5.15.0-203 or later.
2. Do not assume automatic updates took care of it. Ubuntu's automatic updates only install from its security channel. On the 24.04 servers we checked today, the fixed kernel was still in the general updates channel, so automatic updates had not installed it.
3. Install the update. Run sudo apt update and then sudo apt full-upgrade, and confirm a newer kernel is in the list.
4. Reboot. A new kernel does nothing until the server restarts. This is the step that gets skipped. Plan a few minutes of downtime, then run uname -r again to confirm the new version.
5. If you are on 20.04 or older, the fix is not out yet. Limit which networks can reach the server, and plan a move to a supported release.
6. If someone else manages the server, ask them two questions: which kernel is it running, and when was it last rebooted?

What we are doing

We began updating the Ubuntu servers we manage as soon as the fixed kernels appeared, and the rest are being updated and rebooted in scheduled maintenance windows. Managed customers will get a short notice from us before their window and do not need to do anything.

Where EFA fits

• Ubuntu server support. If you have an Ubuntu server and nobody whose job it is to patch it, we can take that on: security updates applied on a schedule you agree to, reboots in a planned window, the result checked afterward, and a short note when it is done.
• EFAshield for Ubuntu servers. EFAshield watches each server around the clock: which security updates are waiting, whether a reboot is still owed, whether services are up, and whether anything changed that should not have. It alerts when a server falls behind, which is how we knew which of ours needed this fix. You can use it to watch your own servers, or have us watch and act on the alerts for you.
• Want a second look? Ask us and we will check a server's kernel and update status with you.
• Stay informed. Sign up for alerts to get advisories like this one by email.

Sources: Ubuntu security page for CVE-2026-98432 (published October 15, 2026; updated November 11, 2026); Ubuntu kernel changelogs; our own checks of Ubuntu 22.04 and 24.04 servers on November 11, 2026. Summary by the EFA Security team. Ubuntu's page is the authority on versions; check it for changes.