What is CVE-2026-98432 and why is it critical?
Ubuntu has accumulated nearly three weeks without releasing a patched kernel for CVE-2026-98432, a critical vulnerability rated CVSS 9.8 en la vulnerabilidad io_uring. Operators running LTS releases have no official vendor update available to close the security gap.
The lack of official packages is actively tracked by the community en el subsistema Bluetooth L2CAP as administrators face ongoing exposure on systems connected directly to the internet.
Which Ubuntu versions and environments are affected?
Releases 22.04, 24.04, and 26.04 LTS are left without an official vendor update, meaning systems cannot rely on standard repository updates to fix the flaw en el desbloqueo GPU.
This gap matters most for internet-facing and multi-tenant self-hosted systems that rely heavily on Ubuntu LTS kernels for isolation and privilege boundaries.
When will the patches arrive and what can administrators do?
Ubuntu has not announced an estimated time of arrival for the fixes, leaving administrators in a difficult operational position.
Administrators must decide whether to stay on the stock kernel, apply out-of-tree mitigations, or move workloads to alternative releases.