Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

majorchord

They also don't provide any mitigation possibilities or instructions... RHEL has one method here: https://access.redhat.com/security/vulnerabilities/RHSB-2026... However they also claim the mitigation "reduces exposure to this vulnerability but cannot fully prevent it", without elaborating on what that means or how it would be possible... I've also not seen anyone else make this claim.

gnabgib

Discussion (842 points, 422 comments) https://news.ycombinator.com/item?id=50337608

jon128

CiCD of Gentoo based systems patched this as early as any other system. I am hoping to see an indication that https://grsecurity.net/ patches preemptively mitigated CVE-2026-98432 but I'm feeling less optimistic. This vulnerability has been a stark reminder to why in some places things are running on HardenedBSD instead of Linux.

superkuh

For those not aware: Freenode.net is not Freenode as we all knew and loved it from the early 2000s to 2021. A hostile take-over of the Freenode LLC resulted in the loss of the domain name and some corporate assets. And the hostile takeover person, Andrew Lee, deleted the Freenode database. It no longer exists. "Freenode" in 2026 is an entity actively hostile to open source software and while what they say here might be true, they are only saying it because it aligns with their biases. They are not a real news source. My mitigation for this lack of patches has been using iptables. iptables -A INPUT -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP

c0l0

It's rather uninteresting to note, once again, that Ubuntu has decided to do this. I would like to know the (official, if any - unofficial/speculative otherwise) reason WHY they have not. It does not seem that complicated to patch, and kernel upgrades are a dime a dozen these days. So what is making them delay a fix for so long?

TacticalCoder

How do we feel now about having pointless services listening for no good reason on open ports? And do we feel about running no firewall? For example Linux works totally fine without running dhcpcd and without running avahi. But on many systems where people think they run "no service", these two shall have ports open on your network and happily listening. Sure, it's typically "only" on your LAN: but how long before we see exploits affecting even private LANs? Tighten your stuff up guys.

warpspin

It's not a zero-day if it's not the zeroth day anymore :-)

TutleCpt

switched to Debian not that long ago. Living the life now.

snapplebobapple

Does ucore hace a patch yet? I justfinished moving all my stuff off ubuntu to ucore last week

pelagicAustral

I have not seen an exploit in the wild. I have at least 20 different servers unpatched (obviously) but the risk is blown way out of proportion. There are a number of mitigation options available.

ay

Just block the ingress IPv4 packets with IP options using nftables or iptables and move on. Why does everything has to come with so much drama these days.

harry8

Question: Every consumer router-wirelessAP I've seen runs linux. I never see security upgrades for the kernels they use. Not one. Not ever. Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself. Update: The context which I should have said is that I think LLMs are giving script kids nation state level tools and expertise. This known bug is always less interesting than the next twenty.

sivakon

https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f... you can use proposed pocket as per this for latest LTS releases

mbac32768

Can't tell if Ubuntu is smart for deferring this patch until a bigger periodic release because there's no evidence it's been exploited and its exploitability is quite limited or if Ubuntu is dumb because there's a lot of publicity around this CVE and it comes off as failing to read the room.

jimrandomh

I was previously Ubuntu-by-default for my random Linux boxen, but going to upgrade things and finding that Ubuntu didn't have a patch has shaken my faith in it. I probably won't choose it for new servers in the future.

TZubiri

RIP Ubuntu was always the benefits of Debian without the inconvenient restrictions anyways, it wouldn't be surprising if their contradictive philosophy caused them to collapse by inability to eat the cake while having it simultaneously. I've switched to Debian in professional servers around the time I learned how to use it without a Graphical Desktop Environments, that's roughly the stage at which a growing devleoper should drop the Ubuntu training wheels. Don't carry that into the workplace whenever possible.

jordemort

Surely there is a more reputable source for this story than a blog stapled to a stolen IRC network

debinguy

I find it odd that no public discussions are highlighting that iptables or nftables can drop this before the kernel CVE is exploitable by a U32 drop rule in raw PREROUTING... sudo iptables -t raw -I PREROUTING -p tcp -m u32 ! --u32 "0>>24&0x0F=5" -j DROP

drnick1

I have been running pure Debian for years on my router/home server. Ubuntu is a superset of Debian that mostly adds stuff that is irrelevant for a networking device. Just stick to base distributions unless you are a very good reason not to.

h4kunamata

Silly those who use Ubuntu in 2026. Ubuntu abandoned its way years ago, closing source, centralising features under Canonical umbrella., etc. Seeing people complaining about Ubuntu tells me more about them than the company itself.