Ubuntu LTS 内核 0day 未修三周
推荐指数 51.0 NO. 022 · 2026.11.03
发布2026/11/02Score291Comments58
简介
CVE-2026-98432（CVSS 9.8）高危漏洞已公开近三周，Ubuntu 22.04/24.04/26.04 LTS 均未发布官方内核补丁。依赖 Ubuntu LTS 内核做隔离的多租户和公网系统目前无官方修复方案，需自行评估风险。
编辑判断
这个延迟暴露了 LTS 发行版安全模型的结构性问题：Canonical 的内核团队规模远小于 Red Hat，遇到非公开 exploit 的响应速度历来偏慢。2024 年类似的 CVE-2024-1086 也是社区先出补丁，Ubuntu 滞后一周以上。
如果你在用 Ubuntu 跑 K8s 集群或云主机，现在就该考虑切换到主线内核（mainline PPA）或临时迁移到 Debian/RHEL 系。多租户平台尤其要注意：这个 CVSS 9.8 的评分意味着本地用户到 root 的提权路径几乎确定存在，容器逃逸风险极高。
长期建议：对内核安全有强需求的团队，应该把 Canonical 的 SLA 纳入技术债评估，而不是默认 LTS 等于安全。
社区反馈
负面 51 条评论
核心争论：Ubuntu LTS 补丁延迟三周的原因不明，社区质疑其安全响应能力与透明度
They also don't provide any mitigation possibilities or instructions... RHEL has one method here: https://access.redhat.com/security/vulnerabilities/RHSB-2026... However they also claim the mitigation "reduces exposure to this vulnerability but cannot fully prevent it", with
> I've also not seen anyone else make this claim. That's what I call Steve Jobs style PR / Marketing you deflect the problem by making another problem to make it seem like you're fully aware. "You're holding the phone wrong"
I've seen another poster successfully updating their Kernel from Ubuntu's "proposed" branch which already has the fix. God knows why they don't merge it into stable.