An actively exploited vulnerability has no fix yet

#The situation

This is not a made-up story. It is based on a warning that actually appeared. When the assumption "updating fixes it" breaks, the operator is forced to make a call. This module is a playbook for the reasoning behind that call. It uses Matching packages against known vulnerabilities, Diagnosis of vulnerabilities likely to be exploited, and Vulnerability acceptance.

#The first 15 minutes: read the warning

Before you rush, check what the words in the warning mean.

Two points are easy to overlook.

• The KEV mark means "exploited somewhere." It does not mean your server is being targeted
• The product the CVE describes and the package you installed are not necessarily the same. This CVE's description is "an out-of-bounds write in Skia in Google Chrome." Whether WebKitGTK is actually affected is not settled by the description alone. In Ubuntu's vulnerability tracker, webkit2gtk is deferred for both 24.04 and 26.04 (Ubuntu CVE)

#Decision points

#Lab: check the exposure

Check how the package is actually used on this machine. These are read-only commands.

# 1. The contents of the warning (read-only)
sudo roamswitch scan-packages | grep -A9 "CVE-2026-3909"

# 2. What installed packages depend on it
apt-cache rdepends --installed libwebkit2gtk-4.1-0

# 3. Running processes that have loaded the library right now
sudo grep -l "libwebkit2gtk\|libwebkitgtk" /proc/[0-9]*/maps | cut -d/ -f3 | while read p; do ps -o comm= -p $p; done | sort | uniq -c

# 4. Whether those processes listen on the network (a count per PID; if all are 0, nothing listens)
for p in $(sudo grep -l "libwebkit2gtk\|libwebkitgtk" /proc/[0-9]*/maps | cut -d/ -f3 | sort -u); do sudo ss -lntup | grep -c "pid=$p,"; done

CVE-2026-3909  [Ubuntu 26.04] webkit2gtk 2.52.6-0ubuntu0.26.04.1 (CVSS 8.8)
  KEV  米国CISAが、実際に悪用されていることを確認した脆弱性です。
  EPSS 2% (2026-11-01)
  修正版: まだありません

Reverse Depends:
  gir1.2-webkit2-4.1
  libedataserverui-1.2-4t64

      1 evolution-alarm
      1 evolution-sourc
      1 gnome-initial-s

0
0
0

#Accept it, with an expiry

Suppose the answers to the three questions lead you to this: "it is used, it is not used in a way that opens crafted data, nothing listens, and there is no mitigation for now." Recording it with a reason and an expiry is called acceptance.

sudo roamswitch vuln-accept Ubuntu webkit2gtk CVE-2026-3909 \
  --version 2.52.6-0ubuntu0.26.04.1 --days 30 \
  --reason 'Ubuntu deferred, no fixed version. The CVE is Chrome Skia. Only Evolution etc. use webkit2gtk, no network listeners. Re-evaluate in 30 days'

Ubuntu webkit2gtk CVE-2026-3909 (2.52.6-0ubuntu0.26.04.1)
  期限: 2026-12-03 (あと29日)
  理由: Ubuntuが対応見送り(deferred)で修正版なし。CVEはChromeのSkia。(以下略)
  記録: tetsuharu (2026-11-03)

The labels mean: 期限 is the expiry (29 days left), 理由 is the reason, and 記録 is who recorded it and when. The nature of acceptance:

• It is not a fix. The warning leaves the "needs action" count and is counted separately as "accepted." It stays in the list
• It has an expiry. The default is 90 days and the maximum is 365 days. When it arrives, the item returns to "needs action" and a record is left
• A reason is required. Later, anyone can read who accepted it and why
• It applies only to that version. If the package changes to another vulnerable version, it becomes a new finding that needs action

#When the expiry arrives

The expiry is a scheduled re-evaluation. On that day, check in this order.

1. Has a fixed version been released? (Check with apt-cache policy and the vendor's vulnerability tracker)
2. Is this package still needed? If you no longer use it, remove it
3. Has the situation changed? (a new way of using it, a case of opening crafted data, and so on)
4. If you still accept it, write a new reason and record it again

#What it cannot see