Ubuntu HWE CVE-2026-98432: Check the Kernel Branch Before Rebooting

I noticed that Ubuntu had added Linux kernel HWE notices dated 12 Nov 2026, so I checked the status of each kernel branch. HWE notices are now available, but the CVE page, last updated on 11 Nov 2026, still shows some branches as Vulnerable and work in progress. Anyone managing web, mail, or other hosts that accept external connections needs to check the kernel branch too. The Ubuntu release name alone does not tell you whether the fix is in place.

What the HWE notices cover

The official notice index shows these two entries, but both USN detail pages returned 503 when I checked. The table therefore lists only the dates and Ubuntu releases shown in the index, without identifying any binary package versions as fixed.

HWE is a kernel for supporting newer hardware on Ubuntu LTS. Machines on the same release may use different kernel branches, so a patch for the standard branch cannot confirm that HWE is fixed.

The main issue is CVE-2026-98432. Ubuntu says the bug occurs during IPv4 TCP connection initialization and may lead to remote code execution. Memory holding IP options may be freed while another CPU is still reading it, causing a use-after-free. The patch waits for existing reads to finish before freeing the memory.

For more details, see the Debian and Ubuntu patch roundup for 11 Nov. This post focuses on tracking HWE branches and checking after a reboot.

Severity and exploitation status

Ubuntu rates CVE-2026-98432 as Critical and lists CVSS 3.1 = 9.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. According to this vector, an attacker can reach it over the network, needs no existing privileges, and does not need to wait for a user to click anything. The impact may include reading or modifying data and disrupting service.

CVE-2026-98432 is not yet in the 10 Nov 2026 KEV catalog (catalogVersion: 2026.11.10), so that edition has no date added or due date for this CVE. Its absence from KEV does not confirm that no attacks have occurred.

Ubuntu's article discusses an unpublished exploit that uses MPTCP, but stresses that the bug is not limited to MPTCP. An exploit used in research is not evidence of attacks in the wild. Disabling MPTCP alone is no substitute for a patch.

Fixed-version status still needs to match the branch

This table comes from the CVE tracker, which lists its last update as 11 Nov 2026. The versions in rows marked work in progress are still being worked on. Do not treat them as evidence that a patch is ready to install.

The two Ubuntu pages still disagree: the article updated on 9 Nov 2026 says patches for Ubuntu 22.04 LTS and later are already in the archive, but the tracker still shows the HWE branches in the table as Vulnerable. The USN index dates the notices to 12 Nov 2026, and the CVE page links to both notices too. But I still could not open the package tables in the full USNs, so I could not confirm the fixed version for each branch from the notices.

Before installing, compare the full USN with the candidate from the official repositories. Use the complete version number, including its suffix, and do not compare a standard kernel branch version in place of HWE.

Other vulnerabilities relevant to servers

I was able to check the details and USN links for two other CVEs, so I have included a summary.

The latter has a CVSS 3.1 score of 7.8, with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It requires existing local privileges. Hosts that let users manage namespaces should check the conditions further. For CVE-2026-99999, see the kernel roundup for 10 Nov.

How to update and schedule a reboot

Start by checking the release, running kernel, and installed packages.

cat /etc/os-release
uname -r
dpkg -l 'linux-image*' | awk '$1 == "ii" { print $2, $3 }'
dpkg-query -W -f='${source:Package}\t${binary:Package}\n' |
  awk '$1 ~ /^linux-meta/ { print $2 }'

uname -r shows the running kernel, while dpkg shows installed packages, which may include both old and new versions. If you cannot find a metapackage, check how that machine receives kernel updates.

1. Check the branch Match the release, running kernel, and installed packages against the USN
2. Confirm the patch Check the fixed version actually released against the APT repositories and the hold list
3. Install Back up data, prepare a recovery method, and read the upgrade list before confirming
4. Reboot and recheck Compare the running kernel with the fixed package, then test services

Update the package lists, then simulate the upgrade first. If you still cannot find a fixed version, keep checking the USN and tracker. The Ubuntu article updated on 9 Nov 2026 says enabling -proposed is no longer necessary to receive this patch, but you still need to check that it matches your HWE branch.

sudo apt update
apt-mark showhold
sudo apt -s upgrade

Once you have confirmed the patch for your branch, update according to Ubuntu's guidance. Check all held or kept back packages and any errors during installation.

sudo apt upgrade

Reboot during the maintenance window you have prepared. Restarting only the web server or PHP does not activate the new kernel.

sudo reboot

The Ubuntu tracker offers a temporary measure to filter IPv4 TCP packets containing IP options, but says this reduces risk and does not provide complete protection. Check how the firewall and container networking are managed before applying it too. Ubuntu's article, meanwhile, says installing the patch is the appropriate measure. These two pages give different guidance. Do not use filtering rules as a substitute for the patch.

Check after rebooting and look for unusual behavior

Once the machine is back, check the running version against the full package version, then compare it again with the fixed version for the same release and branch.

uname -r
dpkg-query -W -f='${binary:Package}\t${Version}\n' "linux-image-$(uname -r)"
systemctl --failed
sudo journalctl -k -b --no-pager

If it still boots into the old kernel, check the boot entry and installation results before closing the task, and test web, mail, and other essential services.

The Ubuntu sources I checked do not specify any IOC for confirming exploitation of CVE-2026-98432. If you see a kernel Oops, panic, or unexpected service outage, investigate further. These symptoms can have other causes too. If you suspect an attack, collect logs and evidence according to your organization's incident response procedure before making further system changes.

If you need to prioritize the work, I recommend checking machines that accept external connections first. Once you confirm the patch for the correct branch, schedule a reboot in the first available maintenance window. For branches still awaiting a fix, keep following the USNs and tracker, and reduce unnecessary access. Do not close the task simply because the update command completed successfully.

Sources: Ubuntu USN-9066-1 index, Ubuntu USN-9018-2 index, Ubuntu CVE-2026-98432, Ubuntu TCP guidance, Ubuntu CVE-2026-99999, Ubuntu CVE-2026-98982, CISA KEV. Also cross-checked against the CVE records for CVE-2026-98432, CVE-2026-99999, and CVE-2026-98982. Notice information is current through 12 Nov 2026, the main tracker lists its last update as 11 Nov 2026, and KEV is the 10 Nov 2026 edition. I still could not open and check the fixed-version tables in the full USNs. I will come back and update this later.