GoKawiil
Tech News
A critical remote code execution vulnerability rated 9.8 on the CVSS scale, tracked as CVE-2026-98432, remains unpatched in Ubuntu's 22.04, 24.04, and 26.04 LTS kernels almost three weeks after disclosure. Canonical has not released updated kernel packages or given a timeline for when fixes will ship.
A critical remote-code-execution bug in the Linux kernel's TCP stack, CVE-2026-98432 (CVSS 9.8), has existed since 2016 and affects nearly all Linux servers. Debian shipped a patch on October 16, but as of November 2 every supported Ubuntu release, including LTS versions, is still listed as vulnerable, more than two weeks later and days after a working root exploit was reportedly demonstrated.
A developer has released an updated version of a website tracking Linux system call tables across architectures, including x64, ARM, RISC-V, MIPS and others. The site now exposes calling conventions per architecture and offers a JSON API, along with per-kernel-version data showing when syscalls were added or removed.
Gregory Kurtzer, founder of Rocky Linux and CIQ, has built Ginux, a new Rust-based x86-64 kernel written largely by an AI agent in 11 days. Unlike Rocky Linux, Ginux is not a fork of Linux but an independent kernel with its own memory management, scheduler and filesystems, though it implements the Linux ABI so unmodified Linux binaries can run on it. The project currently only works inside a QEMU virtual machine, lacking GPU, NVMe or physical hardware support and any independent security audit.
Amutable, co-founded by SystemD creator Lennart Poettering after he left Microsoft, has opened signups for a private preview of Amutable Foundations, a managed service for running cryptographically verified, image-based Linux systems. The platform builds on two existing open-source tools, tine and Quarry, and adds a hosted control plane that manages signed OS images, updates and vulnerability fixes. Machines boot only signed images and continuously send signed reports of their state, which Amutable's control plane checks against the declared configuration using systemd-report, an experimental systemd 260 feature the company helped develop.
Phoronix reports the Linux 7.4 merge window logged 19,671 commits since version 7.3, the highest tally in the kernel's history. The kernel source tree now totals over 41.6 million lines, with roughly half a million lines of actual code added during this window alone, according to cloc-based measurements.
A writer with a decade-old laptop ineligible for Windows 11 tried ChromeOS Flex before installing Fedora Linux, a process that took under 15 minutes. They reported the machine ran smoothly on the GNOME desktop, handling multiple apps and browser tabs without noticeable slowdown.
Attackers tried to exploit CVE-2026-97229, a maximum-severity remote code execution flaw in GitLab's CI/CD regex compiler, against Alpine Linux's development infrastructure on October 20-21, repeatedly crashing GitLab processes. Alpine found no direct evidence code was executed or packages tampered with, but due to missing logs it could not rule out compromise, so it rebuilt its GitLab instance and reset all passwords.
A use-after-free bug in Linux's IPv4 TCP handshake, present since kernel 4.4, has been patched upstream with fixed releases spanning 5.10 through 7.3, but Ubuntu and RHEL have not yet shipped fixes as of October 31. Anthropic says its Claude model produced a working proof-of-concept that gains root access with no credentials on servers running multipath TCP listeners, and Go's security team notes Go programs enable such listeners by default.
The Enlightenment project has shipped version 0.28 of its lightweight desktop environment, bringing a range of improvements to the open-source window manager and shell. The release continues ongoing development of the EFL-based desktop, which remains a niche alternative to mainstream Linux desktop environments.
Anthropic security researchers created a working exploit for CVE-2026-98432, a use-after-free bug in the Linux kernel's IPv4 TCP code rated 9.8/10 in severity. The flaw lets unauthenticated attackers achieve remote root code execution on servers running Multipath TCP listeners, and it also affects ordinary TCP connections across kernels back to version 4.4, including Ubuntu, RHEL and Rocky Linux, though RCE on non-MPTCP servers hasn't been publicly shown.
A use-after-free bug has been identified in the Linux kernel's IPv4 TCP handshake code, where a race condition between processors can leave a stale pointer to a freed IP options object. The CVE record rates it 9.8 on CVSS 3.1 as a worst-case network-reachable flaw, while Red Hat scores it 5.9 for its supported products, and Anthropic's Frontier Red Team separately demonstrated a working remote root exploit in a lab setup using a Multipath TCP listener.