tl;dr: Ubuntu has gone nearly three weeks without shipping a patched kernel for CVE-2026-98432, a CVSS 9.8 RCE affecting 22.04, 24.04, and 26.04 LTS releases. No ETA has been provided, leaving internet-facing and multi-tenant hosts exposed with no official fix. Admins must choose between running the vulnerable stock kernel, applying unofficial mitigations, or migrating workloads to already-patched kernels.