Ubuntu
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
End of support
- Ubuntu 22.04 LTS: standard support (May 2027) ends 31 May 2027 (vendor)
Security timeline
- Security update reported by Trail of BitsTrail of Bits uses Codex to speed up backporting security fixes to stable Linux releases
- Vulnerability reported by Cyber Security NewsCritical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
- Vulnerability reported by Cyber Security NewsAnthropic says its AI model built a working root exploit for critical Linux kernel flaw CVE-2026-98432
Recent news
Trail of Bits uses Codex to speed up backporting security fixes to stable Linux releases
Trail of Bits describes using Codex agents to prepare backports of security fixes to stable Linux kernels, Ubuntu LTS and Fedora packages, with human engineers reviewing and submitting patches. By 29 October the project had helped deliver fixes for 149 distinct CVEs into stable kernel releases. The authors argue that thousands of known CVEs remain unfixed in stable branches, including a critical TCP stack flaw that had not reached distribution kernels weeks after upstream patching.
Critical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
A certificate validation flaw in LXD and Incus lets a remote attacker append a trusted certificate's public part to their own chain and be accepted as its owner, bypassing authentication without credentials, a stolen private key or user interaction. Incus rates it critical with a CVSS score of 10.0 and says it has existed since the initial release, while Canonical's LXD record is CVE-2026-112816, which Ubuntu rates as Medium priority. Exposed HTTPS management listeners should be patched and restricted to trusted hosts, as neither advisory reports active exploitation.
Anthropic says its AI model built a working root exploit for critical Linux kernel flaw CVE-2026-98432
Anthropic says an unreleased Claude research model produced a zero-click exploit for CVE-2026-98432, a use-after-free race condition in the Linux kernel's IPv4 TCP handling that gives unauthenticated root command execution, with a claimed 9.8 CVSS score. Upstream fixes are available in stable branches such as 5.10.272, 5.15.223 and 6.6.159, but distribution fixes are uneven, with Ubuntu and Red Hat Enterprise Linux reportedly lacking patched kernels as of 30 October. Teams should prioritise internet-facing servers, apply vendor kernel updates, reboot, and check whether multipath TCP listeners are needed.