This is why I don’t take Ubuntu seriously. They just take whatever is the latest kernel when they release the next Ubuntu version regardless of whether it is a LTS kernel or not. Which means they often end up with an upstream EOL kernel they themselves have to backport patches to for years, which in turn lead to delays like this. It’s not going to get any better going forward.

The article sounds a bit sloppy.
In general this is a pretty low risk exploit. Can be used for trolling, but not to steal data or get rce.

The freed memory can be read again as the child socket is constructed, which leads to a use‑after‑free that can trigger a kernel crash or a denial of service. The vulnerability does not directly leak data.

https://app.opencve.io/cve/CVE-2026-98432

The only mention I see of things beyond that are claims of rce on systems with multi-path tcp, which is rare.
This sounds like another overblown ai-company-discovered vulnerability. They have every reason to disclose poorly and create the biggest possible fear. Even the php exploit, which was a lot worse than this, still had way more publicity and fear than it deserved.