You suggest that Canonical has concluded that this issue is not so bad and so it is Ok that they have not released a fix.

Customers and users expect alacrity for CVSS 9.8 CVEs in un-hardenable services like the TCP stack.

Whatever Canonical's security record or process has been for other CVEs does not excuse silence and delay in this case. Canonical, unfortunately, does not get to silently decide such a categorized CVE "is not trivially exploited" without criticism, and likely consequences.

> Your comment should be higher. Most indignant comments here are variants of "Tell me you don't know about CVE triage and Linux kernel releases without telling me you don't know about them".

Ubuntu managed to release the updated 26LTS kernel on October 28, but the other LTSes have been sitting around since 26 or 28, so I'm wondering why they haven't been moved to "security" or "updates" in the several days since.

Especially since their page on it mentions October 15

* https://ubuntu.com/security/CVE-2026-98432

and Debian released a couple of weeks ago.