alt Hacker NewsWTF Ubuntu?
Comments
For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:
* https://launchpad.net/ubuntu/+source/linux
You can pull them down with a "-t" added to your apt-get (but will not appear by default).
26LTS had the new kernel go to the updates/security repos on October 28.
Well, I did it. This was the straw that broke the camel’s back: I have moved over to Rocky Linux. Took me maybe four hours to do the full transition.
I am more a RedHat user, and Ubuntu never felt really comfortable for me. I don’t like having to do incremental upgrades every two years or so; I would rather do a single big upgrade about once every 7-8 years and have a rock solid development environment. Also, `dnf` is simpler and more stable than the mess of `apt-get` and `unattended-upgrades`.
It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.
The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.
Just a title designed to generate the maximum outrage followed by a few meaningless lines.
To be fair: while critical (9.8) it has an EPSS score of <1% (probability of it being actually used). According to [1], [2], and others, at worst the issue results in a kernel crash or a denial of service. I read the post by Anthropic too, but something just doesn't reconcile there between everyone saying its a DoS, and Anthropic alone claiming RCE. So far the advisories I read state "under specific conditions ... result in a kernel crash" and similar.
[1] https://app.opencve.io/cve/CVE-2026-98432 [2] https://aws.amazon.com/security/security-bulletins/2026-160-...
I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone to care" phase which we all know so well...
Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.
Maybe it's time for StealMyBitcoinV2…
Here is Ubuntu’s webpage on this vulnerability:
https://ubuntu.com/security/CVE-2026-98432
It’s still, over a week after disclosure and patches, unpatched in Ubuntu.
As for me, a part of me wants to move over to Rocky Linux 10.
The bad news is that Canonical is slow to fix critical issues. The good news is that Canonical is full of people with exceptional SAT math scores.
It’s not a good look that Ubuntu is taking its time with this patch even for paying customers, but I do have to question how widely exploitable this is. If your site is mission-critical, it most likely has a load balancer or reverse-proxy in front of it that’s probably already filtering it out. Companies like AWS have already confirmed that their load balancers filter it.
Remember that the AI companies benefit from creating panic every time there’s a new security exploit.
" Anthropic says it built a working exploit that gets root on a server. A total takeover."
From the linked Ubuntu CVE page
" Vulnerable system - Confidentiality impact Low
Vulnerable system - Integrity impact Low
Vulnerable system - Availability impact High
" suggesting it's more of a denial of service. So which is it, there are dozens of kernel CVEs fixed in the linked debian email.
The takeaway -- prefer Debian over Ubuntu for my servers.
When AWS is shipping patches for Amazon Linux 2 and Ubuntu is still waiting.. yeah.
I get the frustration, but isn't there an iptables rule that is a viable mitigation? Why not deploy that first?
It's not *just* Ubuntu is it? I think Redhat still hasn't released any patches? (their status still says 'ongoing')
What is keeping people on Ubuntu instead of just using Debian? I'm genuinely curious. What is Ubuntu offering that Debian doesn't provide?
You get a very different CVSS score depending on the formula you use. Ubuntu's response page lets you select between the two.
(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)
This is the straw that broke the camel's back. I am moving back to Debian stable now. Having NVIDIA drivers and Wlan drivers back in 2014 was great, but this is not acceptable.
All the people working at Canonical have gone through the Canonical hiring process, which is quite possibly the worst in the global industry and I can't imagine anyone competent getting through it.
I'm switching to Debian for my companies and personal projects.
For 15 years or so, I used and recommended Ubuntu. But this is unacceptable and I won't be looking back.
Worth noting that RHEL, the Linux version Red Had sells licenses/paid support for, also didn't update it for weeks
I've switched my default to AlmaLinux. Was a fan of Ubuntu since 8.04 (Hardy Heron) but stopped since Canonical pushed hard on Ubuntu Pro.
I’ve always hated Ubuntu. I simply don’t understand the pitch as to why someone would use Ubuntu over just good ol fashion Debian. Better yet: FreeBSD.
maybe once it comes out you will need to pay them to get the patch xD
I suppose this kind of stuff is why you will find some places who roll Debian in prod but almost never find Ubuntu?
on laptops etc. its less impwct because (i think) most people are sensible enough not to have all kinds of listeners open all the time?/(right guys??? ...RIGHT GUYS???)
dont forget it can also be used as LPE if its a local host listener. and LLMs can bake u a nice exploit for it too.
Go Debian or perhaps consider freeBSD or OpenBSD if your workloads permit. they are more feasible, and sensible by the day, not just trying to poop on Linux, its simply much more targeted for now, and because it moves faster, and thus is bigger, it will have more holes.
a lot of ball dropping all around lately in lots of incidents and CVE. stay safe out there!
Calm down, man. I think Ubuntu is doing o.k. here. What is pretty bad that people cannot read advisories anymore and fix there machines, instead crying for their mama (in this case Ubuntu).
Use this firewall rule and you are fine - it blocks the tcp options negoation - and things remain working of course: ` nft add table ip cve_2026_98432 nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }' nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop `
A hot take - agents with root access dynamically updating your system have crossed over the threshold of being more secure than not using them.
I still haven't done this for my servers with SOC2 compliance (for obvious reasons), but I've moved over my personal project servers to this pattern. They all run ubuntu and this CVE was fixed within 1hr of my agent seeing chatter on twitter about it.
Still in the testing phase of this pattern, but while I initially thought it'd be a terrible idea[1], I'm coming around to it more and more with the amount of major CVEs hitting.
I moved over to Debian and haven't looked back, years ago. Why anyone would prefer Ubuntu over Debian, which is a purer, higher quality, more mature distro, is beyond me.
Same with the recent PHP vulnerability Debian had the patch ahead of time. Ubuntu had it many hours later...
We were using ZFS in prod a few years ago, and there was a one-line patch to fix data loss issues.
It took Ubuntu something like 6 months to “backport” it. I’m not at all surprised they are taking forever to patch a severity 11 wormable exploit.
Mildly disappointed, but not surprised. Anyway, the ZFS thing (and, before that, widespread systemd-related breakage of an old LTS) are why I don’t trust them in prod anymore.
This is a valid concern.
AI is now capable of, and being applied to, find so many bugs recently that infrastructure providers need to up their game and respond quickly.
Hopefully this is a passing phase as bugs are quickly patched, and we'll get past it without too many incidents.
Where is my cup to collect all these tears from people upset about free software not getting fixed fast enough?
I wonder what is slower, these people pulling out a credit to pay something or ubuntu fixing their issue?
What would you recommend to use on servers? Would you host you apps off Arch? Or better to take Fedora or similar? I am genuinely interested in answers not distrowars
If anyone is moving away from Ubuntu, I suggest NixOS, especially with LLMs. You will be able to build the machine of your dreams.
I migrated all servers off Ubuntu as well due to this and slow PHP patching as well. Now running a mix of AWS Linux 2023 and Debian.
It is strange, agreed. I just manually mitigated it using Claude and also blocked ipoptions at the router and in every node iptables.
I'll add that they were a day or two late to patch the brotli issue, other than Ubuntu Pro LTS, which was still "under consideration" or whatever they called it, for another few days to a week. https://ubuntu.com/security/CVE-2026-111497 Now it says it's fixed, but on my old server I'm still not getting the updates for whatever reason (maybe I have it set up wrong? I dunno.).
I hate to be the guy to complain about a free service (Ubuntu Pro is a source of revenue, but it's free for individuals) but if I knew this was actually was actually being offered I would (hopefully!) have switched off by now.
beyond the nft/iptables mitigations discussed codex plopped out a kernel livepatch for my ubuntu kernels in about twenty minutes. the functions are ftrace’able so no trampoline/splice shenanigans required.
They haven't patched pwnescape either, which is like 15+ days old - allows for KVM breakout.
Should we also talk about the snaps when trying to install package in Docker image (such as chromium-browser)?
I have been thinking of moving to NixOS from Ubuntu. Are they any better on security updates?
I have fond memories of burning Ubuntu to a CD being my first introduction to Linux. I chose to preserve those cherished memories rather than sully them through actually using Ubuntu.
Withholding security-critical open source contributions to collect subscriptions is really low.
Bye Ubuntu
So nice to see people coming back around to Debian.
Listened to over a decade of people chirping about the new hotness and calling my Debian servers lame, old and busted. Well look at you now!
I used to be a contributor to distros, but I found that Ubuntu simply has no method by which I can fix things and contribute them back.
if only other OSes had the same CUDA support as Ubuntu. Now I know how solidworks users feel..
Article contains the string "hve" which should no doubt be "have"..
I have the same general feelings, but then I recall my years as an OSS developer and being abused by people who contributed absolutely nothing to my projects. Not money, not code, not documentation, not even grammar corrections. I'm sure anyone who's been involved with reasonably popular OSS can relate.
I am not contributing to Ubuntu in any way, and that puts it into perspective.
(I still directly contribute to OSS and release OSS projects, but absolutely refuse to engage with the least bit of hostility. Any of that is an insta-block.)
Edit: Whoah the downvotes and comments. I'm not saying that Ubuntu is doing well here. I'm trying to point out that a a vast percentage of the complainers are not paying customers, and maybe if they did pay, Ubuntu would have more incentive and resources to work more quickly.
> I'm moving all my servers off Ubuntu.
I wish life was that easy.
Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:
> Why is this CVE high priority?
> See ubuntu cvss score
That's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.
I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.
[0] https://ubuntu.com/security/CVE-2026-98432#priority-reason