Reaffirming its commitment to enterprise-grade stability, Canonical announced Monday that CVE-2026-98432, the critical use-after-free in the Linux kernel's IPv4 TCP code, will receive a full 10 years of Long-Term Support on every Ubuntu release it affects.
"Our customers don't like surprises," said Canonical's vice president of enterprise lifecycle, who described the vulnerability as mature, well understood and production-ready. "When you deploy CVE-2026-98432 on Ubuntu, you can be confident it will behave exactly the same way in 2036 as it does today."
Under the plan, the flaw will keep its "Vulnerable, work in progress" status on a predictable cadence, with security engineers refreshing the page's "last updated" date at least twice a month. Ubuntu Pro subscribers will receive two additional years of Expanded Vulnerability Maintenance, and customers on the Legacy add-on can keep the bug through 2041.
Canonical also confirmed that the vulnerability has been certified under FIPS 140-3, allowing federal agencies to be exploited in a fully compliant manner.
Analysts welcomed the announcement.
"Other distros will patch something out from under you in 48 hours, and suddenly your whole threat model is wrong," said Dana Okafor, principal analyst at Halvorsen Research, who advises Fortune 500 clients never to change anything. "Canonical is giving CIOs a vulnerability they can actually budget for."
