For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:

* https://launchpad.net/ubuntu/+source/linux

You can pull them down with a "-t" added to your apt-get (but will not appear by default).

26LTS had the new kernel go to the updates/security repos on October 28.

I'm not seeing CVE-2026-98432 included in the changelog for any of the new kernels on the 28th.

> You can pull them down with a "-t" added to your apt-get (but will not appear by default).

How does that look like exactly?

Your comment should be higher. Most indignant comments here are variants of "Tell me you don't know about CVE triage and Linux kernel releases without telling me you don't know about them". I mean, I also don't know a lot about them, but Canonical's security record has been exemplary in my experience, and I see no solid reason to doubt their process in this instance.

First, if this CVE did truly put every Ubuntu machine on the Internet at risk, we'd know about mass compromises by now, and there haven't been any reports. It means the CVE is not trivially exploited.

Second, the gravity of the CVE dictates the security release cycle. Emergency kernel patches carry risks of their own, and it would be worse to hurry a non-critical patch and crash a part of their massive user base.

Edit: I've been enjoying this comment going up and then into the negatives, what a roller coaster.