> What is Ubuntu offering that Debian doesn't provide?
I have it right now at zero additional effort
2. The LTS releases are supported by Canonical for at least five years on the free tier, and up to fifteen years with paid support contracts.
I believe you can contribute to Ubuntu's source code right? Why don't you fix the issue then?
The beauty of OSS is that you don't need permission from anyone to modify the code to your own needs.
So just as they made it popular, they can make it unpopular. People like me will simply post on our blogs and social media that they should not install Ubuntu. A typical Ubuntu user is not that high on the tech scale, and they listen to people like me for suggestions on which distro.
Cut the pipeline that feeds into it.
IIRC it had minimal HN discussion.
On another note, you can probably easily install the Debian kernel onto your machine.
"But we need signed kernels!" Well, that's a big "I told you so" from the people that were against only a handful of distros being able to create signed kernels with MS derived keys like 15 years ago.
We are in that period between when software was good enough and when software is certified as secure by the writers.
The days of importing frameworks and libraries written by strangers is over. I would say the entire industry is not prepared at this moment for the unpatchable event where the only solution is to power off or disconnect.
Maybe it's time for StealMyBitcoinV2…
Much like with PHP2Shell, it doesn't need to be utterly trivially exploitable to be a big concern.
server: nginx/1.14.0 (Ubuntu)
And Slackware too:
Thu Oct 22 23:04:17 UTC 2026
patches/packages/linux-5.15.223/kernel-generic-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-headers-5.15.223-x86-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-huge-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-modules-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-source-5.15.223-noarch-1.txz: Upgraded.
This update fixes bugs and security issues, including the PwnEscape flaw.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-99999
(* Security fix *)
I stopped using it back in 2004 when Patrick had health problems. It seems to be a passion project and it stopped getting updates while he recovered. There is a community behind it but it may mainly be driven forward by him.
It looks like it's fairly slow to get updates, generally, as the last release was Slackware 15 in 2022. Maybe that reflects it's dictator (his word not mine) or maybe it reflects it's stability.
Yet, despite all that, Slackware got this security fix around 10 days ago.
I haven’t used Ubuntu for a few years now but I’m glad they’re getting this trial by fire now. This new era of software vulnerabilities is going to reduce the viability of a lot of smaller distros who more or less are entirely dependent on upstream for security and reliability. I sincerely wish the Ubuntu folks well but this is a sink or swim moment, and even if they sink it will be a net positive for Linux as a whole as weaker projects get picked off like the slowest antelope in the herd.
"If you're not paying, you're the product-" hey jerks, the analogy doesn't always work
https://ubuntu.com/security/CVE-2026-98432
It’s still, over a week after disclosure and patches, unpatched in Ubuntu.
As for me, a part of me wants to move over to Rocky Linux 10.
Does Rocky use their own community-built packages, or does it use RHEL's?
Because I don't think Red Hat have released patches yet either?
https://access.redhat.com/security/cve/cve-2026-98432
For RedHat/Rocky 10:
https://access.redhat.com/errata/RHSA-2026:93413
Also, a mitigation:
https://access.redhat.com/security/vulnerabilities/RHSB-2026...
I wish life was that easy.
AI is now capable of, and being applied to, find so many bugs recently that infrastructure providers need to up their game and respond quickly.
Hopefully this is a passing phase as bugs are quickly patched, and we'll get past it without too many incidents.
Listened to over a decade of people chirping about the new hotness and calling my Debian servers lame, old and busted. Well look at you now!
See https://repology.org/repositories/graphs
If you pick a specific random package update, nixpkgs often has that update months to years before other distros.
If you pick a specific CVE, nixpkgs usually is better with the exception of embargoed ones, where Ubuntu or Fedora got to prepare their patched packages ahead of time.
NixOS also makes it much easier than ubuntu to install your own patches and version of the linux kernel.
For example, assuming NixOS had not yet released the fixed linux version, 6.18.56 (though it has), you could upgrade to it before NixOS did it upstream with this one line:
boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux_6_18.override {argsOverride = {src = pkgs.fetchurl {url = "mirror://kernel/linux/kernel/v6.x/linux-6.18.56.tar.xz"; }; version = "6.18.56"; modDirVersion = "6.18.56";};});
boot.kernelPatches = [{ patch = ./cve-patch.patch; }];
The debian and redhat based distros all make it so configuring what packages are installed ('apt install' / 'yum install') is a different operation from configuring the packages themselves.
On NixOS, the specification of how to build a package, what package is installed, patches, etc are all in the same language, and so it's a lot more natural to patch things as needed.
And also, LLMs are pretty good at generating working nix, so you can have an agent apply patches to your kernel package with NixOS quite easily. Agents can also do this for ubuntu or redhat, but in my experience they're much worse at it, and it's harder to undo mistakes if they mess up.
> Why is this CVE high priority?
> See ubuntu cvss score
That's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.
I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.
[0] https://ubuntu.com/security/CVE-2026-98432#priority-reason
Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not been true for quite a while, they have now jumped the shark into eel-infested waters; I cannot take them seriously any longer.
I use arch linux for my NAS because it's fun and I don't care if it occasionally goes down but I wouldn't use it for production (on my NAS it's mostly stable but has gone down a few times)
So what's next? Centos is a rolling upgrade, nixos?
VPS/VM? Debian is a great choice. Use it as base and run your software via systemd+podman if you want the most up to date stuff, Debian tends do lag a bit. It is very low maintenance.
Bare metal? Fedora Atomic is awesome. It does require an update every other week since it keeps packages closer to upstreams, but this is where the immutable base shines, any issue is an easy reboot to revert. Also systemd+podman for your own software.
I wouldn't recommend Arch on servers.
Edit: clarified Fedora immutable spins are called Fedora Atomic.
The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.
Just a title designed to generate the maximum outrage followed by a few meaningless lines.
Yes it does? And Ubuntu is selling security subscriptions and doing a poor job of it, These aren't open source volunteers, this is a paid product.
No offense but Anthropic says that every time.
* https://launchpad.net/ubuntu/+source/linux
You can pull them down with a "-t" added to your apt-get (but will not appear by default).
26LTS had the new kernel go to the updates/security repos on October 28.
Not to mention however many production services teams I work with build and maintain that run on Ubuntu.
Ubuntu are dragging their feet and it’s not good enough. Nowhere near good enough.
Get it patched NOW!
And if you’re on here and you work for Ubuntu, then what the hell are you doing reading this when you should be shipping a patch?
Seriously: get on it, will you?
I am a bit surprised by the panic...
(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)
Let's be clear the security vulns will never end and if you're running anything connected to the network eventually you'll get pwned.
Well - Ubuntu sold out to marketing rather than engineering.
Happened to Google too. Compare Google Search to 10 or 15 years ago. Totally useless nowadays.
I am not contributing to Ubuntu in any way, and that puts it into perspective.
(I still directly contribute to OSS and release OSS projects, but absolutely refuse to engage with the least bit of hostility. Any of that is an insta-block.)
But it doesn't sound too hard to backport a patch from Debian to Ubuntu yourself.
So if it's a critical security concern to your company, open your laptop and get to work.
It's still a pretty basic reason businesses might calculate that Ubuntu is a good fit.
When I interviewed with them a couple of years ago, I got the sense there was a lot broken with their culture. It was the best choice back when RedHat/CentOS stopped providing long term security updates, but now that Rocky Linux is around, it’s getting to be time to jump ship again.
I don't remember why exactly but it was definitely just 'linux VPS = Ubuntu' for a long time. I think they got reputation as being the 'just works' option because they were happier to include some non-free graphics drivers etc where Debian was the more pure option but most end users didn't care
But since they added snap and I started running into issues with trying to install Docker etc a few years ago I default to Debian now and most of the time I don't even know which it is.
And don't get me started with Debian testing. I want a LTS distro not a testing one.
If you want real testing, you should run "unstable". If you're in for fun, try experimental.
Running Testing on my desktops and stable on my servers since forever. None of them broke, none of them created problems.
I don't care Stable running 6.x.x. It gets security updates in less than 24h, and is applied automatically before I wake up, and doesn't ship coreutils with 104CVEs, just because it's Rust.
Again. Stable is for servers, testing is for personal use.
I never argued otherwise, ever.
Ubuntu found me (finally, with the tutorialhelp of a localLLM) in 2026, and I don't trust most of the opt-outs.
Now my friends don't have trouble calling doctors, but can't set up port forwarding (not like any games require it anymore).
They also had credible commitments to long term support that brought people on board. I think that was enough to get them on the map, but personally as a desktop user, I haven't used it in a while, mostly sticking to Debian and Arch.
I may be biased as a Debian user, but if Ubuntu now reacts slower than Debian this may push some people to reconsider their choice.
Ubuntu kernels are not the one that Debian uses. The latest stable Debian is based on a 2 years old Kernel ( 6.12 ).
I feel like we're close to a post-distro era of operating systems though. My ansible playbook customizes so much already it wouldn't take too much more to just start from debian tbh.
I use desktop Ubuntu because it's up to date and it just works for me, and I can play the latest games in it with Steam + Proton. I don't have to tweak it or do any additional downloading of stuff besides the Nvidia drivers (I actually don't remember how I installed them).
Can I do this with Debian, in a no fuss way? (I know this can be done in any distro, that's why I'm stressing "no fuss").
On Arch I just installed the flatpak and didn't think about it, everything works.
I'm on an nvidia jetson which comes out of the box with Ubuntu pre-installed (it's slightly more complicated but that's the gist). You can run other OSes but it is a messy experience and you can easily run into problems.
Yes, it is shitty from nvidia that they do it this way. But it is also convenient.
A gradually increasing number of popular userland applications have been publishing their own apt repositories however so this is less of a problem now than it used to be.
Over the years though I've found that I much prefer Debian's relative stability and more thoughtful, if slightly plodding, release cadence.
I'm on Kubuntu (home installs) but have been looking to move since Ubuntu went over to Snaps and started breaking everything (MX looks most likely for me). The task of moving the family over is stopping me; I've been using Kubuntu for a very long time now.
But 15-20 years ago it was easier to install the nonfree stuff on ubuntu, like drivers and DVD playback and stuff. I don’t know if its still like that.
I never understood ubuntu as a server over debian, but for a desktop it was a nicer experience for a while.
I don’t use Ubuntu but use Fedora (and its derivatives) partially for that reason.
I might be moving over to Rocky Linux 10.
Five years of guaranteed updates, with an option to pay for another five years ticks the box for accreditors and the like.
The much vaguer Debian policy that a release will be supported for some undetermined period based on how frequently they release, and then get some kind of volunteer-based LTS support for a couple of years after that, and then maybe further through some third-party ELTS program is a much harder sell.
Surprised how many answers here are on "social" reasons, and ignoring that Ubuntu does provide genuine additions to Debian.
Ubuntu includes additional proprietary drivers to Debian. So there are legitimate hardware cases were Ubuntu will work out the box and Debian won't. I can't speak for how many people need those drivers, and how much of choice is down to defaults/inertia etc.
From hearing interviews with PopOS folk, I think this is also a big reason people choose Ubuntu as a base for a lot of Distros instead of Debian.
What are the numbers of people still installing servers on the real hardware and needing these proprietary drivers?
Is AI changing the game where more people want bare metal and GPUs with proprietor drivers?
A fair few years ago I did run Ubuntu on my desktop and laptop when I wanted some more similarity with my servers which ran Debian.
And similar breakdowns with Fedora/RHEL.
But Ubuntu or Fedora on a server? No thanks.
Unfortunately, they did in recent history manage to still break iptables, zfs, nilfs and a bunch of machines with weird (arguably broken) firmware anyway, so my personal comparison between Debian (or simply directly the Kroah-Hartman/Levin stable upstream) and the Ubuntu backports is not exactly in favor of Ubuntu.
Debian used to move a bit slow in terms of userspace, and that's true, but for servers, that's a non-issue for the last 20 years or so (from my experience).
On the Desktop side, Fedora and Ubuntu moves faster on the userspace front, but if your system is behind a NAT, and you know what you're doing, Debian Testing is just as good, more stable and it's rolling (except when it's feature freeze, but a stable workhorse is better than a shiny but breaking one).
Debian allows me to sleep well at night, provides guaranteed updates, and works rock solid all-round, so I won't be touching Ubuntu for the foreseeable future. Esp, with controversial choices like uutils, etc.
I used to like Ubuntu and Canonical products and these days I’m more indifferent towards them. Their products have a place, but I wish Canonical would stop killing off some of the more interesting side projects.
I moved all my new server/service deployments back to Debian around 2021/2022 (bullseye era).
I really don’t care what I run on, as long as it’s some flavour of Linux, it works reliably, and it’s secure.
Are those fatal flaws? No. But lots of people just don't want to deal with it. And there's a market for that.
1. Hardware generally just works
2. Videos that use patented formats just play without fiddling
3. Proprietary closed-source software, if they even support Linux, usually releases Ubuntu binaries before anything else
I had to go through the torturous path of Ubuntu -> Mint -> Mint Debian -> Debian. The last step was after I used a Debian live disk to do something and I could see that the stories were nonsense; just something that had adhered to the word Debian in my mind through repetition.
The two worst parts about it were 1) that I had long left Ubuntu on servers and had been using Debian there for years - I was just afraid of the desktop for some reason, and 2) that if I had just listened 15-20 years ago when people told me that FrankenDebians were nothing but problems, I would have never been caught in the net.
I've never been a fan of Ubuntu's business practices, but I'm just generally not into Debian derivatives anymore. If I were to leave Debian, it would be for an entirely different (and philosophically different) distro. I probably make an exception for Devuan, because it's only trying to change one thing (that I think of as the biggest threat to Linux, the final boss evil spawn of RedHat.) Devuan is an escape hatch for when the rugpull happens.
Let's see you do it.
If they don’t have the resources to handle this, they should be recruiting more help from their community
Canonical absolutely is marketing enterprise security updates (at least for those who pay). I don't see this in the paid ESM updates channel yet either?
(Also, ubuntu already has the fix. What they're dragging their feet on is releasing the updated version. I don't think anyone outside ubuntu can help with that process)
Ubuntu Pro is $500 per machine for enterprise.
> Oh and btw, distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix. Meanwhile Ubuntu, made by a company that sells security subscriptions, hasn't. This is true as of 2026-11-02 14:48 UTC.
Just not picked up by this distribution which advertises itself as having “Enterprise-grade support and integration”. https://ubuntu.com/desktop#:~:text=Enterprise%2Dgrade%20supp...
And this is how Ubuntu describes the vulnerability to sysadmins:
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free inet_opt and ireq_opt after an RCU grace period
tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.
Another cpu can concurrently process a retransmitted SYN for the same
request socket, and send a SYNACK from tcp_check_req().
tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
under rcu_read_lock() only, and ip_build_and_send_pkt() and
ip_options_build() then read opt->optlen twice.
Note that the SYNACK timer itself is not an issue: it holds a
reference on its request socket, and inet_csk_reqsk_queue_drop()
calls timer_delete_sync() before the child can be freed.
Since commit 079096f103fa (“tcp/dccp: install syn_recv requests
into ehash table”), request sockets are processed without holding
the listener lock, so nothing prevents the child socket from being
freed while the SYNACK is still being built. TCP child sockets do
not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
with a plain kfree(), leading to a use-after-free in
ip_options_build().
A similar issue exists with request socket migration
(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
program). reqsk_timer_handler() clones the request socket with
inet_reqsk_clone(), so that the old request socket and its clone
share the same ireq_opt, then reqsk_migrate_reset() clears the
pointer in the old one. Another cpu holding a reference on the old
request socket can still be using these options (sending a SYNACK,
or creating a child in tcp_v4_syn_recv_sock()) when the clone is
freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().
Readers already use RCU, and other paths replacing inet_opt
(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
tcp_v4_reqsk_destructor() as well.
IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
duplicates the options. tcp_v6_reqsk_destructor() has the same
migration issue with ipv6_opt, which is only set by CALIPSO. This
will be addressed in a separate patch.
I have to add that for me, testing definitely breaks stuff sometimes. Nothing beyond my ability to fix, though. Nothing beyond anyone's ability now that AI is around.
That's interesting, can you give an example? Asking as a curious Debian user.
And Ubuntu 24.04 LTS is using 6.8.
Ubuntu releases a new version every six months, but an LTS — which is probably what most people run in production — only every two years. Debian releases come out every two years.
So if you only run Ubuntu LTS, the release cadence is the same as Debian.
Which only came out a few months ago, and which only recently released its .1, so the do-release-upgrade message only recently appeared for most people.
I'd be interested to know how many folks have changed their current production over to 26TLS in the last six months. I'm guessing not a lot.
So yes, there is a newer LTS, but what is its current market share as compared to 24 TLS (or even 22LTS)?
Ubuntu releases its LTSes in even years, and Debian does its releases in odd years:
* https://en.wikipedia.org/wiki/Debian_release_version_history...
Why not just install a newer Linux version from the official backports repository if you need it?
You either want to have the new stuff or LTS. You can't have both.
ForHackernews•1h ago