You get a very different CVSS score depending on the formula you use. Ubuntu's response page lets you select between the two.

(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)