One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at:
Has there been a documented exploit of this CVE on Ubuntu or on the other distros before they were patched?
imjonse
You were wrong to have confidence in Ubuntu before this, you are doubly wrong for it to still be "shaking your confidence".
You are expecting some quality that was never there. Visibly so.
marcosdumay
Seems like a good time to ask: what do people use, if not ubuntu, on a web server? Like for example for a rails app, on EC2... asking for a friend (who is me).
atestu
Aren't the patches out since a day?
adsfasf
I've always wondered what is going on with Ubuntu. Right now, after the ICC rug pull, Europe is interested in an OS not controlled by the USA. Canonical should go all-in on an opportunity like this.
But even basic company tooling like Landscape is not doing great (Oh, look, all your machines are not fully patched 5 minutes after we released a patch. Sound the alarms)
Meanwhile, they spend a lot of effort on things that ultimately not gain traction. Upstart or snap might be technically OK, but socially they are dead ends. Half baked Rust coreutils in an LTS? Who asked for that?
I've seen multiple major CVEs and showstopper bugs just sit there, while Debian and Red Hat move weeks faster than them, and other individuals and big companies providing ppas with workarounds.
I like the company, but some major bigwigs over there need to wake up.
comments (10)
* https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...
The fixes were in the "proposed" repo since October 26 (noble) and 28 (resolute):
* https://launchpad.net/ubuntu/+source/linux
One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at:
* https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
The kernels goes through an QA testing processes, and per this September post, they're looking at shortening the timeframe for kernel updates:
* https://canonical.com/blog/accelerating-delivery-of-cve-fixe...
throw0101c
imjonse
You are expecting some quality that was never there. Visibly so.
marcosdumay
atestu
adsfasf
But even basic company tooling like Landscape is not doing great (Oh, look, all your machines are not fully patched 5 minutes after we released a patch. Sound the alarms)
Meanwhile, they spend a lot of effort on things that ultimately not gain traction. Upstart or snap might be technically OK, but socially they are dead ends. Half baked Rust coreutils in an LTS? Who asked for that?
I've seen multiple major CVEs and showstopper bugs just sit there, while Debian and Red Hat move weeks faster than them, and other individuals and big companies providing ppas with workarounds.
I like the company, but some major bigwigs over there need to wake up.
hyperman1
https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
bon0r
WTF Ubuntu?
https://news.ycombinator.com/item?id=50337608
ChrisArchitect
infamouscow
https://news.ycombinator.com/item?id=50348688
Or install newest mainline test kernel, but it had less testing, YMMV:
https://news.ycombinator.com/item?id=50358616
xet7