Ubuntu Leaves Servers Exposed to Critical Kernel Flaw

Ubuntu’s real failure here is trust: an upstream fix and Debian packages existed while Ubuntu’s own advisory still listed supported releases as vulnerable.

• –Anthropic’s exploit reportedly took about 53 minutes to reach root, but its code and configuration remain unpublished and independently unreproduced.
• –The vulnerability affects core IPv4 TCP code; MPTCP is the demonstrated attack path, not proof that every Ubuntu server is immediately exploitable.
• –Go 1.24 and later can enable MPTCP on listening sockets by default, creating a surprising risk for otherwise ordinary network services.
• –Operators should prioritize fixed kernels, disable unnecessary MPTCP, and audit exposed services rather than assume LTS status guarantees timely remediation.
• –Ubuntu’s “timely patches” promise becomes difficult to defend when Debian shipped a fix while Ubuntu still showed production releases as vulnerable.