Ask HN: What in the world is taking Ubuntu so long?
Ubuntu has CVE-2026-98432 marked as a 9.8, but yet it's coming up on a week with no update to fix it. It's still marked as "work in progress" (though at least now they've listed a mitigation): https://ubuntu.com/security/CVE-2026-98432 I've had mitigations in place for a week, but this response is really shaking my confidence in Ubuntu. I'm just trying to understand what is going on with Ubuntu. Do they have too many kernels (that page is loooong), do they not have enough automation in the build/test pipeline, are their engineers overwhelmed? We are moving into a world where there are going to be vastly more security issues; if you can't keep up now, where are you going to be in the next 6 months? For a long time keeping on top of OS updates has been a huge part of keeping the attackers at bay. However, the world is changing.
Discussion Highlights (17 comments)
adsfasf
Aren't the patches out since a day?
AnotherGoodName
It's Canonical. The company that literally asks for high school grades and a multi-page essay on any job application and will pass if you're not in the 99th percentile of year 9 maths even while requiring many years experience (which means you probably don't even know what your year 9 maths scores were). All the while they pay a fraction of any other Bay Area tech company. What i just described isn't a joke or an exaggeration either. It's literally part of the application process and you can look this up. Anyway they are quite simply hopelessly mismanaged and no one should be touching Canonical products at this point.
infamouscow
This is a problem with LTS distro kernels in general. You're trading the feeling of stability at the kernel level for security updates.
chrisvalleybay
There has been a workaround available since nov 2: https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...
ChrisArchitect
Discussion: WTF Ubuntu? https://news.ycombinator.com/item?id=50337608
bon0r
it's rolling out.. https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
throw0101c
As outlined in this weblog post: * https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f... The fixes were in the "proposed" repo since October 26 (noble) and 28 (resolute): * https://launchpad.net/ubuntu/+source/linux One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at: * https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/ The kernels goes through an QA testing processes, and per this September post, they're looking at shortening the timeframe for kernel updates: * https://canonical.com/blog/accelerating-delivery-of-cve-fixe...
ravenstine
I was asking "what in the world is taking Ubuntu so long" back in 2006.
imjonse
Has there been a documented exploit of this CVE on Ubuntu or on the other distros before they were patched?
nekusar
Maybe the patch is going through their interview process?
marcosdumay
You were wrong to have confidence in Ubuntu before this, you are doubly wrong for it to still be "shaking your confidence". You are expecting some quality that was never there. Visibly so.
machska
Does Ubuntu Pro get this fix any sooner, or is it the same for everyone?
atestu
Seems like a good time to ask: what do people use, if not ubuntu, on a web server? Like for example for a rails app, on EC2... asking for a friend (who is me).
xet7
According to Canonical product team, fixed Ubuntu kernel is at proposed: https://news.ycombinator.com/item?id=50348688 Or install newest mainline test kernel, but it had less testing, YMMV: https://news.ycombinator.com/item?id=50358616
lousken
Why is anyone surprised about this? Ubuntu had a shitty track record of critical vulns for a long time, seeing so many in Wazuh was fun.
dennysora-main
I now rely on AI to fix them, otherwise I simply can't wait for them to release updates.
VCFundedGenYer
Ubuntu is the Microsoft of the Linux world. Endlessly corporate, terrible decisions, and bureaucracy that’s prevents things from getting done quickly. If you rely on Ubuntu, move to Debian.