Date: 30th October, 2026
A new vulnerability was published in the Linux kernel, CVE-2026-98432. The flaw is in the part of Linux that accepts new network connections. An attacker could use it to crash a server and, in the worst case, take control of it, without logging in. Ubuntu rates it high. The attack is difficult because it depends on precise timing. No reports indicate this vulnerability has been exploited so far.
Ubuntu has not released a fix yet. Ubuntu is preparing fixes for 22.04 and 24.04.
Who is affected
This is a flaw in Linux itself, so it affects almost every current Linux server, not only Ubuntu.
How to protect your site
- We will install the fix when Ubuntu releases it.
- Limit who can reach your servers. The attack only works against a port that is open to the attacker. Ports that do not need to be public, such as SSH (port 22), should only accept connections from known IP addresses. Webscale has already enforced SSH restrictions via Security Groups. If you would like us to review any existing IPs in your Security Group, kindly open a ticket, and we'll get back to you.
- Our team is also reviewing temporary protections that could be applied before the fix is released. We will let you know if we put any in place.
What happens next
When Ubuntu releases the fix, we will install it on the servers we manage. A kernel update only takes effect after the server restarts. Where a restart could affect your site, we will agree on a time with you first.
We will send another update when the fix is available.
Further support
If you have any questions about this advisory, please reach out to our support team through your customer portal or by emailing support@webscalenetworks.com
Comments
0 comments
Please sign in to leave a comment.