WTF Ubuntu?

ForHackernews

This turnaround time is appalling, especially given that Debian shipped a fix weeks ago. Poor show, Canonical.

arjie

It is strange, agreed. I just manually mitigated it using Claude and also blocked ipoptions at the router and in every node iptables.

bortimus

When AWS is shipping patches for Amazon Linux 2 and Ubuntu is still waiting.. yeah.

origini

Its not just Canonical but yes when a few month ago the local root exploit appeared, it wasn't fixed for a few days either.

Gabriel54

What is keeping people on Ubuntu instead of just using Debian? I'm genuinely curious. What is Ubuntu offering that Debian doesn't provide?

mag7269

Where is he moving his shit to, then?

gonzalohm

"The free operating system that I use is not giving me enterprise level security updates" I believe you can contribute to Ubuntu's source code right? Why don't you fix the issue then?

curt15

Did Ubuntu Pro customers get the fix?

512bitCrypto

Should we also talk about the snaps when trying to install package in Docker image (such as chromium-browser)?

worthless-trash

Its only the media / publicity that drives this one, there were worse within the last year that nobody seems to care about.

stroebs

I've switched my default to AlmaLinux. Was a fan of Ubuntu since 8.04 (Hardy Heron) but stopped since Canonical pushed hard on Ubuntu Pro.

linuxftw

Everyone is just using Ubuntu for free of charge for the most part. You get what you pay for. On another note, you can probably easily install the Debian kernel onto your machine. "But we need signed kernels!" Well, that's a big "I told you so" from the people that were against only a handful of distros being able to create signed kernels with MS derived keys like 15 years ago.

pizzafeelsright

In the current age of AI, open source means exploits can discovered directly through the code. The flip side is the patches can also be managed. We are in that period between when software was good enough and when software is certified as secure by the writers. The days of importing frameworks and libraries written by strangers is over. I would say the entire industry is not prepared at this moment for the unpatchable event where the only solution is to power off or disconnect.

_joel

Switch to vanilla Debian. What I did, no real issues that weren't easy to fix. Rock solid still.

StrLght

Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well. Maybe it's time for StealMyBitcoinV2…

jmclnx

>Oh and btw, distros run by volunteers (Debian, Arch, Alpine...) And Slackware too: Thu Oct 22 23:04:17 UTC 2026 patches/packages/linux-5.15.223/kernel-generic-5.15.223-x86_64-1.txz: Upgraded. patches/packages/linux-5.15.223/kernel-headers-5.15.223-x86-1.txz: Upgraded. patches/packages/linux-5.15.223/kernel-huge-5.15.223-x86_64-1.txz: Upgraded. patches/packages/linux-5.15.223/kernel-modules-5.15.223-x86_64-1.txz: Upgraded. patches/packages/linux-5.15.223/kernel-source-5.15.223-noarch-1.txz: Upgraded. This update fixes bugs and security issues, including the PwnEscape flaw. For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-99999 (* Security fix *) From: https://ftp.osuosl.org/pub/slackware/slackware64-15.0/Change...

vanschelven

I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone to care" phase which we all know so well...

stackghost

I suspect at this point that it’s a bunch of techno-bureaucrats at Canonical who are dogmatically sticking with their release cadence because artificial justifications. I have worked in big organizations where The Process, or The $place Way of Doing Things, has become so big that the bureaucracy takes on a life of its own and you end up having a whole team of people who just manage the process so that the people actually doing the work can maybe get something done. I haven’t used Ubuntu for a few years now but I’m glad they’re getting this trial by fire now. This new era of software vulnerabilities is going to reduce the viability of a lot of smaller distros who more or less are entirely dependent on upstream for security and reliability. I sincerely wish the Ubuntu folks well but this is a sink or swim moment, and even if they sink it will be a net positive for Linux as a whole as weaker projects get picked off like the slowest antelope in the herd.

pixelesque

It's not *just* Ubuntu is it? I think Redhat still hasn't released any patches? (their status still says 'ongoing')

strenholme

Here is Ubuntu’s webpage on this vulnerability: https://ubuntu.com/security/CVE-2026-98432 It’s still, over a week after disclosure and patches, unpatched in Ubuntu. As for me, a part of me wants to move over to Rocky Linux 10.