Canonical’s Ubuntu CVE tracker, last updated November 4, 2026, marked the standard linux packages for Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as “Vulnerable, work in progress” for PwnEscape (CVE-2026-99999). It listed a separate Ubuntu 22.04 linux-kvm entry with the same status. Canonical’s tracker gives a target build for each row.
Five Ubuntu package entries in the tracker
| Ubuntu release | Package flavor | Tracker status | Target build |
| 22.04 LTS | linux | Vulnerable, work in progress | 5.15.0-203.213 |
| 24.04 LTS | linux | Vulnerable, work in progress | 6.8.0-149.149 |
| 26.04 LTS | linux | Vulnerable, work in progress | 7.0.0-43.43 |
| 26.10 | linux | Vulnerable, work in progress | 7.3.0-10.10 |
| 22.04 LTS | linux-kvm | Vulnerable, work in progress | 5.15.0-1112.117 |
A target build is the version listed for that package while its tracker status remains “Vulnerable, work in progress.” Canonical tracks kernel flavors separately, so the standard linux row does not stand in for linux-kvm, cloud, HWE, FIPS or other package families.
PwnEscape concerns packet processing in the Linux host kernel. Updating a virtual machine’s guest operating system does not update the host kernel; NeoTeo’s earlier coverage of the upstream PwnEscape fix provides background on the kernel-level change.
Ubuntu priority and CVSS scores
Canonical assigns the vulnerability Ubuntu priority Medium. Its tracker separately lists a CVSS 3.1 score of 9.3, Critical, and a CVSS 4.0 score of 6.9, Medium. CVSS, the Common Vulnerability Scoring System, uses versioned scoring methods; Ubuntu’s priority is a separate field from either score.
