Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:

> Why is this CVE high priority?

> See ubuntu cvss score

That's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.

I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.

[0] https://ubuntu.com/security/CVE-2026-98432#priority-reason

For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:

* https://launchpad.net/ubuntu/+source/linux

You can pull them down with a "-t" added to your apt-get (but will not appear by default).

26LTS had the new kernel go to the updates/security repos on October 28.

It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.

The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.

Just a title designed to generate the maximum outrage followed by a few meaningless lines.

I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone to care" phase which we all know so well...

Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.

Maybe it's time for StealMyBitcoinV2…

Here is Ubuntu’s webpage on this vulnerability:

https://ubuntu.com/security/CVE-2026-98432

It’s still, over a week after disclosure and patches, unpatched in Ubuntu.

As for me, a part of me wants to move over to Rocky Linux 10.

I'm switching to Debian for my companies and personal projects.

For 15 years or so, I used and recommended Ubuntu. But this is unacceptable and I won't be looking back.

" Anthropic says it built a working exploit that gets root on a server. A total takeover."

From the linked Ubuntu CVE page

" Vulnerable system - Confidentiality impact Low

Vulnerable system - Integrity impact Low

Vulnerable system - Availability impact High

" suggesting it's more of a denial of service. So which is it, there are dozens of kernel CVEs fixed in the linked debian email.

It's not *just* Ubuntu is it? I think Redhat still hasn't released any patches? (their status still says 'ongoing')

When AWS is shipping patches for Amazon Linux 2 and Ubuntu is still waiting.. yeah.

I get the frustration, but isn't there an iptables rule that is a viable mitigation? Why not deploy that first?

What is keeping people on Ubuntu instead of just using Debian? I'm genuinely curious. What is Ubuntu offering that Debian doesn't provide?

This is the straw that broke the camel's back. I am moving back to Debian stable now. Having NVIDIA drivers and Wlan drivers back in 2014 was great, but this is not acceptable.

All the people working at Canonical have gone through the Canonical hiring process, which is quite possibly the worst in the global industry and I can't imagine anyone competent getting through it.

You get a very different CVSS score depending on the formula you use. Ubuntu's response page lets you select between the two.

(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)

Worth noting that RHEL, the Linux version Red Had sells licenses/paid support for, also didn't update it for weeks

I've switched my default to AlmaLinux. Was a fan of Ubuntu since 8.04 (Hardy Heron) but stopped since Canonical pushed hard on Ubuntu Pro.

Did Ubuntu Pro customers get the fix?

I'll add that they were a day or two late to patch the brotli issue, other than Ubuntu Pro LTS, which was still "under consideration" or whatever they called it, for another few days to a week. https://ubuntu.com/security/CVE-2026-111497 Now it says it's fixed, but on my old server I'm still not getting the updates for whatever reason (maybe I have it set up wrong? I dunno.).

I hate to be the guy to complain about a free service (Ubuntu Pro is a source of revenue, but it's free for individuals) but if I knew this was actually was actually being offered I would (hopefully!) have switched off by now.

Where is my cup to collect all these tears from people upset about free software not getting fixed fast enough?

I wonder what is slower, these people pulling out a credit to pay something or ubuntu fixing their issue?

Calm down, man. I think Ubuntu is doing o.k. here. What is pretty bad that people cannot read advisories anymore and fix there machines, instead crying for their mama (in this case Ubuntu).

Use this firewall rule and you are fine - it blocks the tcp options negoation - and things remain working of course: ` nft add table ip cve_2026_98432 nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }' nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop `

I’ve always hated Ubuntu. I simply don’t understand the pitch as to why someone would use Ubuntu over just good ol fashion Debian. Better yet: FreeBSD.

Same with the recent PHP vulnerability Debian had the patch ahead of time. Ubuntu had it many hours later...

If anyone is moving away from Ubuntu, I suggest NixOS, especially with LLMs. You will be able to build the machine of your dreams.

This is a valid concern.

AI is now capable of, and being applied to, find so many bugs recently that infrastructure providers need to up their game and respond quickly.

Hopefully this is a passing phase as bugs are quickly patched, and we'll get past it without too many incidents.

beyond the nft/iptables mitigations discussed codex plopped out a kernel livepatch for my ubuntu kernels in about twenty minutes. the functions are ftrace’able so no trampoline/splice shenanigans required.

I moved over to Debian and haven't looked back, years ago. Why anyone would prefer Ubuntu over Debian, which is a purer, higher quality, more mature distro, is beyond me.

What would you recommend to use on servers? Would you host you apps off Arch? Or better to take Fedora or similar? I am genuinely interested in answers not distrowars

I migrated all servers off Ubuntu as well due to this and slow PHP patching as well. Now running a mix of AWS Linux 2023 and Debian.

It is strange, agreed. I just manually mitigated it using Claude and also blocked ipoptions at the router and in every node iptables.

They haven't patched pwnescape either, which is like 15+ days old - allows for KVM breakout.

https://ubuntu.com/security/CVE-2026-99999

I mean....insert Linux distro of any kind. Yes, hardware support is good, but most distros are otherwise pretty awful in many other regards now.

Should we also talk about the snaps when trying to install package in Docker image (such as chromium-browser)?

I have been thinking of moving to NixOS from Ubuntu. Are they any better on security updates?

kindda interested in how many routers are vulnerable

I have fond memories of burning Ubuntu to a CD being my first introduction to Linux. I chose to preserve those cherished memories rather than sully them through actually using Ubuntu.

Withholding security-critical open source contributions to collect subscriptions is really low.

Bye Ubuntu

if only other OSes had the same CUDA support as Ubuntu. Now I know how solidworks users feel..

Article contains the string "hve" which should no doubt be "have"..

I used to be a contributor to distros, but I found that Ubuntu simply has no method by which I can fix things and contribute them back.

So nice to see people coming back around to Debian.

Listened to over a decade of people chirping about the new hotness and calling my Debian servers lame, old and busted. Well look at you now!

I have the same general feelings, but then I recall my years as an OSS developer and being abused by people who contributed absolutely nothing to my projects. Not money, not code, not documentation, not even grammar corrections. I'm sure anyone who's been involved with reasonably popular OSS can relate.

I am not contributing to Ubuntu in any way, and that puts it into perspective.

(I still directly contribute to OSS and release OSS projects, but absolutely refuse to engage with the least bit of hostility. Any of that is an insta-block.)

Edit: Whoah the downvotes and comments. I'm not saying that Ubuntu is doing well here. I'm trying to point out that a a vast percentage of the complainers are not paying customers, and maybe if they did pay, Ubuntu would have more incentive and resources to work more quickly.

Debian is already on 6.12.115, the stable kernel from 3 days ago. Who knows what horrors were fixed?

They're too busy replacing something else with a Rust rewrite.

The fact that Ubuntu (still) hasn't patched this (despite the fact that I'm pretty sure Opus 5.5 could figure it out in a few minutes) is pathetic. And it's very annoying for me because I have two servers that I need to consider migrating off of it now because Ubuntu clearly doesn't care all that much about security vulnerabilities like this. Get your shit together, Canonical. We all know you can do way, way better than this.

> I'm moving all my servers off Ubuntu.

I wish life was that easy.

How about WTF linux?

The TCP/IP stack has one of the most stable requirements bases of any component -- modern PCs can communicate with decades-old software and hardware, and the composition of layers design means the code can be easily tested, and is a great candidate for analysis via formal methods. And once you have a formally verified implementation, the stable requirements means you can make it safe and then leave it alone.

Good job on moving away from Ubuntu, in the end Debian has been there longer and it's more trustworthy.

Its not just Canonical but yes when a few month ago the local root exploit appeared, it wasn't fixed for a few days either.

In the current age of AI, open source means exploits can discovered directly through the code. The flip side is the patches can also be managed.

We are in that period between when software was good enough and when software is certified as secure by the writers.

The days of importing frameworks and libraries written by strangers is over. I would say the entire industry is not prepared at this moment for the unpatchable event where the only solution is to power off or disconnect.

sudo sysctl -w net.mptcp.enabled=0

Normal Ubuntu approach. Not news. I have personally got a bunch on 10+ year old bug tickets on Launchpad and only lately got a feedback like: "is this still relevant"?

Of course, if one hides a bug long enough it will eventually disappear or become irrelevant.

Yes, indeed, WTF Ubuntu?

Switch to vanilla Debian. What I did, no real issues that weren't easy to fix. Rock solid still.

Do most VPSs even use distro kernels rather than kernels from the VPS provider?

The "WTF" is unwaranted, it's really not that easy to write a weaponized exploit for a bug like that one.

I am a bit surprised by the panic...

Its only the media / publicity that drives this one, there were worse within the last year that nobody seems to care about.

> Anthropic says it built a working exploit that gets root on a server. A total takeover.

No offense but Anthropic says that every time.

Why use Debían when you can use Rocky or Alma?

Ubuntu has always been worse-Debian, I've always said it, now I have the strongest evidence in my favor.

Inflicting some pain to sell Ubuntu Pro maybe?

Debian vs Ubuntu debate officially settled today!

I genuinely want to understand why people use Ubuntu, and especially for servers. I’m not trolling or whatever the proper word for it. It’s not sarcasm either. I must be missing something, I guess. What is the reason? Especially if you’re not paying for it. But if you’re paying for it, I’m still curious.

Reminder that Ubuntu used to bundle spyware - I dropped it at that point and never looked back, trust broken.

https://www.fsf.org/blogs/rms/ubuntu-spyware-what-to-do

Given that Ubuntu is downstream from Debian, I can't think of a single good reason why Ubuntu wouldn't just release Debian's patch.

>Oh and btw, distros run by volunteers (Debian, Arch, Alpine...)

And Slackware too:

    Thu Oct 22 23:04:17 UTC 2026
    patches/packages/linux-5.15.223/kernel-generic-5.15.223-x86_64-1.txz:  Upgraded.
    patches/packages/linux-5.15.223/kernel-headers-5.15.223-x86-1.txz:  Upgraded.
    patches/packages/linux-5.15.223/kernel-huge-5.15.223-x86_64-1.txz:  Upgraded.
    patches/packages/linux-5.15.223/kernel-modules-5.15.223-x86_64-1.txz:  Upgraded.
    patches/packages/linux-5.15.223/kernel-source-5.15.223-noarch-1.txz:  Upgraded.
      This update fixes bugs and security issues, including the PwnEscape flaw.
      For more information, see:
        https://www.cve.org/CVERecord?id=CVE-2026-99999
      (* Security fix *)

From: https://ftp.osuosl.org/pub/slackware/slackware64-15.0/Change...

Did Omarchy patch it? Anyone knows? (Not that I'm using it now, but I'm interested.)

Ubuntu seems like it hasn’t been in very good hands for quite a while now

From the same company that demands high school transcripts and club affiliations for engineers 20+ years out of high school.

Creepy as hell company. Had a good free Linux distro, but it's not that good anymore. It's coasting on inertia these days.

OpenBSD got a recent GeFS (COW FS, but far lighter than BTRFS and not to mention ZFS) update, I wish 8.1 or 8.2 had it stabilized, because the issues with FFSv2 would end in the spot and maybe even steal some server machines to GNU/Linux.

There seems to be something off about this post. One hour in and hundreds of comments.

Either this was used to pop something big, or this is a jia tan situation going down.

I thought there was a flamebait automation that was prevent this sort of velocity (unless overridden)

Yes, this is a fuckup by Canonical

But it doesn't sound too hard to backport a patch from Debian to Ubuntu yourself.

So if it's a critical security concern to your company, open your laptop and get to work.

> distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix.

Well - Ubuntu sold out to marketing rather than engineering.

Happened to Google too. Compare Google Search to 10 or 15 years ago. Totally useless nowadays.

They are rewriting those bugs in Rust.

you mean to say you didnt review the codebase before putting it in production? you get what you pay for

I mean.. how many people are using multipath on Ubuntu? This is a big issue for datacenter systems that are using fancy networking features that Ubuntu users probably aren't.

i would then give claude/codex full access, and ask it to do a temp patch, if they allow lol.

Honestly, I agree. I need to provision a new VPS for a personal site and I’m holding off until it’s resolved.

Not to mention however many production services teams I work with build and maintain that run on Ubuntu.

Ubuntu are dragging their feet and it’s not good enough. Nowhere near good enough.

Get it patched NOW!

And if you’re on here and you work for Ubuntu, then what the hell are you doing reading this when you should be shipping a patch?

Seriously: get on it, will you?

I've all but stopped using traditional "Linux distributions" honestly.

Debian is, in every way that I know, superior to Ubuntu.

  - no snap nonsense where you can't turn off upgrades
  - stays close to upstream LTS kernels
  - does not carry around some ridiculous kernel patch set
  - no irritating adware on login

I switched after the aforementioned patch set broke containers and destroyed my server instance a couple years ago. Apparently nobody bothered to check containers before releasing the kernel.

> and I considered it the solid, no-drama LTS distro. Fuck that now.

There's been lots of drama on Ubuntu which OP either completely missed or ignored. Ubuntu has been getting worse for over a decade now.

Everyone is just using Ubuntu for free of charge for the most part. You get what you pay for.

On another note, you can probably easily install the Debian kernel onto your machine.

"But we need signed kernels!" Well, that's a big "I told you so" from the people that were against only a handful of distros being able to create signed kernels with MS derived keys like 15 years ago.

[dead]

[dead]

[dead]

[dead]

[dead]

[dead]

[dead]

[flagged]

Where is he moving his shit to, then?

This turnaround time is appalling, especially given that Debian shipped a fix weeks ago. Poor show, Canonical.

I suspect at this point that it’s a bunch of techno-bureaucrats at Canonical who are dogmatically sticking with their release cadence because artificial justifications. I have worked in big organizations where The Process, or The $place Way of Doing Things, has become so big that the bureaucracy takes on a life of its own and you end up having a whole team of people who just manage the process so that the people actually doing the work can maybe get something done.

I haven’t used Ubuntu for a few years now but I’m glad they’re getting this trial by fire now. This new era of software vulnerabilities is going to reduce the viability of a lot of smaller distros who more or less are entirely dependent on upstream for security and reliability. I sincerely wish the Ubuntu folks well but this is a sink or swim moment, and even if they sink it will be a net positive for Linux as a whole as weaker projects get picked off like the slowest antelope in the herd.

> I'm moving all my servers off Ubuntu. Well justified.

What difference does it make? Version N (TEH LATEST) is considered secure until it isn't and the same show repeats with version N+1 but we already know it's also compromised.

"The free operating system that I use is not giving me enterprise level security updates"

I believe you can contribute to Ubuntu's source code right? Why don't you fix the issue then?