fp.

Ubuntu has CVE-2026-98432 marked as a 9.8, but yet it's coming up on a week with no update to fix it. It's still marked as "work in progress" (though at least now they've listed a mitigation):

https://ubuntu.com/security/CVE-2026-98432

I've had mitigations in place for a week, but this response is really shaking my confidence in Ubuntu. I'm just trying to understand what is going on with Ubuntu. Do they have too many kernels (that page is loooong), do they not have enough automation in the build/test pipeline, are their engineers overwhelmed?

We are moving into a world where there are going to be vastly more security issues; if you can't keep up now, where are you going to be in the next 6 months?

For a long time keeping on top of OS updates has been a huge part of keeping the attackers at bay. However, the world is changing.

Comments

adsfasf•3h ago

Aren't the patches out since a day?

guyisit•3h ago

Holy crap, they are showing in apt… why in the world wouldn’t they update the dang CVE page?!

I agree though, this took too long.

slekker•3h ago

Likely needs a human from another department to press a button, and they have not "synced" with the team publishing the patch.

chasd00•2h ago

They need to "stack hands" and "gain alignment". ( i work in consulting :P )

khoury•2h ago

Thank you for this! Finally patched

AnotherGoodName•3h ago

It's Canonical. The company that literally asks for high school grades and a multi-page essay on any job application and will pass if you're not in the 99th percentile of year 9 maths even while requiring many years experience (which means you probably don't even know what your year 9 maths scores were). All the while they pay a fraction of any other Bay Area tech company.

What i just described isn't a joke or an exaggeration either. It's literally part of the application process and you can look this up.

Anyway they are quite simply hopelessly mismanaged and no one should be touching Canonical products at this point.

hmokiguess•3h ago

Can you share the backstory behind your gripe, this comment feels oddly specific to what appears unrelated to someone outside who doesn't know what you know. Makes me think there's some personal and deeper roots behind it

EDIT: I'm shocked.

pluc•3h ago

It's pretty straightforward, go have a look at their careers site and application form. What parent is saying I believe is that they're leaving a lot of talent on the table because of questionable hiring practices; talent that would help proactively (or at least reactively) mitigate things like this.

AnotherGoodName•3h ago

Look it up so it isn't just coming from me. It's a quick Google "Canonical hiring process" and there's no shortage of wait wtf was that type of posts on this. You can also go on their website and try to apply for any job just to be further shocked.

They ask for; A massive multi-choice questionaire. A massive free form list of questions. An ask for an essay. Grades from High school through to University. That's to start the process of many rounds of interviews followed by finally an interview with Mark Shuttleworth himself who's known to say no on vibes.

Personally i applied for a senior management role after ~30years working at multiple other very large and well known companies. The pay at canonical was literally 1/5th but i was curious. I was honest about my high school scores and immediately given a thanks for your time but we will pass dialog on their website after stating maths scores in year 9. I'm not even fucking kidding. Obviously i was gobsmacked. It was a blessing to get knocked back that early all things considered.

Not my post but has more detail and matches what i saw. Be amazed at the insanity in the leadership at Canonical that allows for this; https://www.reddit.com/r/recruitinghell/comments/15kj845/can...

We're talking put him in a straightjacket loony tunes type of shit when it comes to Shuttleworth. You can also look up various personal interactions. It's utterly fucking insane.

infamouscow•3h ago

This is a problem with LTS distro kernels in general. You're trading the feeling of stability at the kernel level for security updates.

layer8•3h ago

This is not a problem with Debian LTS, you’re getting timely security updates. Debian fixed this vulnerability three weeks ago within two days: https://www.debian.org/lts/security/

vanschelven•2h ago

For Ubuntu it was _all_ their kernels though...

mxey•1h ago

LTS distros can track the LTS kernels and they’ve all been updated

Maxatar•1h ago

Ubuntu is the only Linux distro with an LTS release that has not patched this issue, so saying this is a problem with LTS distro kernels in general is categorically false.

chrisvalleybay•3h ago

There has been a workaround available since nov 2: https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...

InsidiousWombat•3h ago

The fix is to install Debian

fodkodrasz•2h ago

Maybe... IBM RHEL. Or Arch. Or NixOS. Or Fedora. Anything that doesn't ship apt.

tlamponi•2h ago

They all had flaws and holes in their package manager in the past, or how are they magically 100% secure?

icedchai•2h ago

Or build your own kernel from kernel.org and install that. I moved one of my Ubuntu dev boxes to 7.3.1.

throw0101c•2h ago

> since nov 2

Since October 26 (noble) and 28 (resolute), when the kernel versions in question hit "proposed". November 2 is just the weblog post, but the solution was available the week before.

ChrisArchitect•2h ago

Discussion:

WTF Ubuntu?

https://news.ycombinator.com/item?id=50337608

bon0r•2h ago

it's rolling out..

https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/

throw0101c•2h ago

As outlined in this weblog post:

* https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...

The fixes were in the "proposed" repo since October 26 (noble) and 28 (resolute):

* https://launchpad.net/ubuntu/+source/linux

One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at:

* https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/

The kernels goes through an QA testing processes, and per this September post, they're looking at shortening the timeframe for kernel updates:

* https://canonical.com/blog/accelerating-delivery-of-cve-fixe...

ravenstine•2h ago

I was asking "what in the world is taking Ubuntu so long" back in 2006.

imjonse•2h ago

Has there been a documented exploit of this CVE on Ubuntu or on the other distros before they were patched?

wtch98•1h ago

I haven't had a documented packet with IPOptions arrive on any of my firewalls, the packets are typically dropped, so exploiting remotely is going to be very difficult. In theory you could use another exploit and then lateral move in some networks which don't drop them at a router level.

talon8635•1h ago

Here’s the real answer. It’s not as scary as the original reporters made it out to be.

nekusar•1h ago

Maybe the patch is going through their interview process?

marcosdumay•1h ago

You were wrong to have confidence in Ubuntu before this, you are doubly wrong for it to still be "shaking your confidence".

You are expecting some quality that was never there. Visibly so.

machska•1h ago

Does Ubuntu Pro get this fix any sooner, or is it the same for everyone?

bakugo•1h ago

My understanding is that everyone gets this at the same time.

Ubuntu Pro provides security updates for packages that wouldn't otherwise be supported by Canonical at a given point in time. If your version of Ubuntu is still within the (non-extended) support period, kernel security updates are always provided regardless of Pro.

atestu•1h ago

Seems like a good time to ask: what do people use, if not ubuntu, on a web server? Like for example for a rails app, on EC2... asking for a friend (who is me).

esikich•1h ago

I switched back to Debian.

sgc•1h ago

Me too

cantalopes•1h ago

I think debian is a polular choice

1over137•1h ago

FreeBSD

mad182•1h ago

I personally use Debian both on my servers and desktops, for the last 15 years or so.

qwerpy•1h ago

Ubuntu has been the easy default for things like WSL (Windows Subsystem for Linux) for my coding on Windows, and a linux VM on my home server. But I don't really like the idea of having a distro that doesn't treat security patching with urgency in the age of AI-fueled exploits. Need a standard distro with decent hardware support, low churn, and fast patching.

People are saying Debian. What are the tradeoffs? (other than faster patching on Debian of course)

xet7•1h ago

According to Canonical product team, fixed Ubuntu kernel is at proposed:

https://news.ycombinator.com/item?id=50348688

Or install newest mainline test kernel, but it had less testing, YMMV:

https://news.ycombinator.com/item?id=50358616

BeetleB•2h ago

Reminds me of Epic (healthcare company). I was close to finishing grad school, and they wanted my SAT scores. When I gave it to them, they couldn't stop gushing. I wanted to wash my hands with a lot of soap at that point.

lotsofpulp•2h ago

In the US, businesses ask for it because the SAT serves (or used to serve) as a decent proxy for IQ. A business cannot ask an applicant to take an intelligence aptitude test without a lot of extra cost to ensure the business complies with Griggs v. Duke Power Co (1971), so the cheaper workaround is to ask for SAT scores in conjunction with other proxies such as the school into which you were able to gain admission.

BeetleB•1h ago

> In the US, businesses ask for it because the SAT serves (or used to serve) as a decent proxy for IQ. A business cannot ask an applicant to take an intelligence aptitude test without a lot of extra cost

Epic actually did (does?) administer a full blown "entrance exam" - generic problem solving skills, with some basic coding and math stuff. They literally arrange with the university to administer it in a classroom setting. So yeah, kind of like an aptitude test.

See https://pigment.is/blogs/blogs/epic-systems-skills-assessmen...

I actually don't mind that, as it ensures all applicants are being judged on a level field.

It's quite rare for people graduating with a BS to be quizzed about SAT scores - the focus tends to be more on GPA, etc. But asking for SAT scores when you've been in grad school for so long...? Kind of ridiculous. And if you are going to ask, might as well ask for the GRE scores instead.

They also did (do?) a full personality quiz. You know, the type where they give you a scenario, and say are you more of A or B, and you often find yourself to be neither or both...

tptacek•48m ago

Businesses can and do ask applicants to take general cognitive tests, without excess compliance costs. IQ testing is presumptively legitimate for essentially all white collar jobs. The biggest companies that administer these tests for hiring companies have logo crawls that include a few of the best known companies in the world.

The reason more companies don't use IQ tests is that they don't work well for candidate qualification. Also, candidates hate them.