tl;dr: Ubuntu has failed to patch CVE-2026-98432, a critical (CVSS 9.8) remote root exploit in the Linux kernel's TCP code, more than two weeks after Debian shipped a fix and six days after a working exploit became known. All supported Ubuntu releases, including LTS, remain listed as vulnerable, despite Canonical's marketing promises of "timely patches" and paid security subscriptions. The author is migrating all servers off Ubuntu and notes that volunteer-run distros like Debian, Arch, and Alpine have already patched the flaw.