Grype is reporting vulnerability CVE-2026-43500 Ubuntu Kernel Dirty Frag in a fixed kernel

[nba1992]

What happened:

grype_kernel_bug.txt

that as as upstream fixed version.

According to the https://ubuntu.com/kernel, i tested in multiple hosts:

vagrant@site-builder:~$ cat /proc/version_signature
Ubuntu 7.0.0-27.27-generic 7.0.6

vagrant@site-builder:~/STVL-8183-LINUX-FIX-DIRTY-FRAG$ cat /proc/version_signature
Ubuntu 7.0.0-29.29-generic 7.0.12

and yet, GRYPE version 0.114.0 is reporting the vulnerability (in attach).

What you expected to happen:

Since the upstream version is a fixed version, i was not expecting this vulnerability to be reported.

How to reproduce it (as minimally and precisely as possible):

Following your installation steps:

curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin
time sudo grype / --output json --file result_${VB_HOSTNAME}_clean.json

Anything else we need to know?:

Environment:

• Output of grype version:
• OS (e.g: cat /etc/os-release or similar):

vagrant@site-builder:~$ grype version
Application:         grype
Version:             0.114.0
BuildDate:           2026-06-05T16:10:04Z
GitCommit:           ef8e65adb2dec760f1f923e635da4c7696d3c295
GitDescription:      v0.114.0
Platform:            linux/amd64
GoVersion:           go1.26.3
Compiler:            gc
Syft Version:        v1.45.1
Supported DB Schema: 6
vagrant@site-builder:~$ cat /etc/os-release
PRETTY_NAME="Ubuntu 26.04 LTS"
NAME="Ubuntu"
VERSION_ID="26.04"
VERSION="26.04 LTS (Resolute Raccoon)"
VERSION_CODENAME=resolute
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=resolute
LOGO=ubuntu-logo
vagrant@site-builder:~$