You suggest that Canonical has concluded that this issue is not so bad and so it is Ok that they have not released a fix.

Customers and users expect alacrity for CVSS 9.8 CVEs in un-hardenable services like the TCP stack.

Whatever Canonical's security record or process has been for other CVEs does not excuse silence and delay in this case. Canonical, unfortunately, does not get to silently decide such a categorized CVE "is not trivially exploited" without criticism, and likely consequences.