Ubuntu’s TCP Kernel Fix Is Available, but Check Your Kernel Flavour First

Two Ubuntu 22.04 machines can give different answers to the same security question. One may run the ordinary 5.15 kernel; another may use the 6.8 hardware-enablement kernel. Canonical’s tracker for CVE-2026-98432 lists a fix for the former while the latter still shows work in progress. Check which one you actually have.

The flaw concerns IPv4 TCP connection handling and can allow remote code execution. Canonical gives it critical priority. Its November 9 announcement update says standard-support fixes have reached the normal Ubuntu archive, so the earlier proposed-pocket instructions are no longer necessary. The individual package rows still matter.

Read the package name before the version

Run uname -r for the active kernel. Next, use dpkg -l 'linux-image*' to list image packages and find those marked ii. The first command describes what is running; the second can also reveal a newer image that has not yet been booted.

For the ordinary linux source package, Canonical lists fixed revisions of 5.15.0-203.213 for Ubuntu 22.04, 6.8.0-149.149 for 24.04, 7.0.0-43.43 for 26.04 and 7.3.0-10.10 for 26.10. Match each number to its release. They are package revisions, and uname does not print the complete package version in that format.

Now consider the exception. In the tracker checked on November 12, whose last-update date is November 11, Ubuntu 22.04’s linux-hwe-6.8 row remains vulnerable, with a fix in progress. Its linux-aws-6.8 row already has a fix, 6.8.0-1069.74~22.04.1. The shared 6.8 prefix does not make the packages interchangeable. Follow the row for your source package and kernel flavour, including cloud or HWE variants.

The reboot is part of the repair

Canonical recommends sudo apt update followed by sudo apt upgrade. Read the proposed changes, then check that the update finished successfully. If a download fails or dependencies cannot be resolved, deal with that error before treating the machine as patched. Our earlier APT update check explains the value of checking installed revisions after an update.

Once the fixed image is installed, schedule the required reboot. Keep a known working boot option available. When the machine returns, run uname -r again and compare the active kernel with the image you installed. An old kernel still running after a reboot calls for a look at the boot selection, rather than another identical package command.

Older releases need the same care

Ubuntu 20.04 illustrates the problem too. Its ordinary linux row still showed a fix pending, while linux-hwe-5.15 listed a fixed Ubuntu Pro package. Neither “20.04 is fixed” nor “20.04 has no fix” describes both cases accurately.

Canonical also warns that the vulnerability is not specific to Multipath TCP. Disabling MPTCP because a discussed exploit uses it does not prove protection against the underlying flaw. Use the live CVE table to identify the right update, and finish by verifying the kernel that the machine is running.