Ask HN: What in the world is taking Ubuntu so long?
79 points - today at 2:58 PM
Ubuntu has CVE-2026-98432 marked as a 9.8, but yet it's coming up on a week with no update to fix it. It's still marked as "work in progress" (though at least now they've listed a mitigation):
https://ubuntu.com/security/CVE-2026-98432
I've had mitigations in place for a week, but this response is really shaking my confidence in Ubuntu. I'm just trying to understand what is going on with Ubuntu. Do they have too many kernels (that page is loooong), do they not have enough automation in the build/test pipeline, are their engineers overwhelmed?
We are moving into a world where there are going to be vastly more security issues; if you can't keep up now, where are you going to be in the next 6 months?
For a long time keeping on top of OS updates has been a huge part of keeping the attackers at bay. However, the world is changing.
Comments
What i just described isn't a joke or an exaggeration either. It's literally part of the application process and you can look this up.
Anyway they are quite simply hopelessly mismanaged and no one should be touching Canonical products at this point.
* https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...
The fixes were in the "proposed" repo since October 26 (noble) and 28 (resolute):
* https://launchpad.net/ubuntu/+source/linux
One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at:
* https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
The kernels goes through an QA testing processes, and per this September post, they're looking at shortening the timeframe for kernel updates:
* https://canonical.com/blog/accelerating-delivery-of-cve-fixe...
https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
WTF Ubuntu?