alt Hacker NewsWTF Ubuntu?
Comments
> I'm moving all my servers off Ubuntu.
I wish life was that easy.
if only other OSes had the same CUDA support as Ubuntu. Now I know how solidworks users feel..
Article contains the string "hve" which should no doubt be "have"..
Good job on moving away from Ubuntu, in the end Debian has been there longer and it's more trustworthy.
Its not just Canonical but yes when a few month ago the local root exploit appeared, it wasn't fixed for a few days either.
In the current age of AI, open source means exploits can discovered directly through the code. The flip side is the patches can also be managed.
We are in that period between when software was good enough and when software is certified as secure by the writers.
The days of importing frameworks and libraries written by strangers is over. I would say the entire industry is not prepared at this moment for the unpatchable event where the only solution is to power off or disconnect.
I'm not finding a reference to CVE-2026-98432 on the stable updates mailing list or in changelogs for 7.2 series.
How about WTF linux?
The TCP/IP stack has one of the most stable requirements bases of any component -- modern PCs can communicate with decades-old software and hardware, and the composition of layers design means the code can be easily tested, and is a great candidate for analysis via formal methods. And once you have a formally verified implementation, the stable requirements means you can make it safe and then leave it alone.
sudo sysctl -w net.mptcp.enabled=0
Switch to vanilla Debian. What I did, no real issues that weren't easy to fix. Rock solid still.
Normal Ubuntu approach. Not news. I have personally got a bunch on 10+ year old bug tickets on Launchpad and only lately got a feedback like: "is this still relevant"?
Of course, if one hides a bug long enough it will eventually disappear or become irrelevant.
Yes, indeed, WTF Ubuntu?
Do most VPSs even use distro kernels rather than kernels from the VPS provider?
The "WTF" is unwaranted, it's really not that easy to write a weaponized exploit for a bug like that one.
I am a bit surprised by the panic...
I mean....insert Linux distro of any kind. Yes, hardware support is good, but most distros are otherwise pretty awful in many other regards now.
Its only the media / publicity that drives this one, there were worse within the last year that nobody seems to care about.
The fact that Ubuntu (still) hasn't patched this (despite the fact that I'm pretty sure Opus 5.5 could figure it out in a few minutes) is pathetic. And it's very annoying for me because I have two servers that I need to consider migrating off of it now because Ubuntu clearly doesn't care all that much about security vulnerabilities like this. Get your shit together, Canonical. We all know you can do way, way better than this.
Debian is already on 6.12.115, the stable kernel from 3 days ago. Who knows what horrors were fixed?
> Anthropic says it built a working exploit that gets root on a server. A total takeover.
No offense but Anthropic says that every time.
kindda interested in how many routers are vulnerable
Why use Debían when you can use Rocky or Alma?
Inflicting some pain to sell Ubuntu Pro maybe?
Ubuntu has always been worse-Debian, I've always said it, now I have the strongest evidence in my favor.
Debian vs Ubuntu debate officially settled today!
>Oh and btw, distros run by volunteers (Debian, Arch, Alpine...)
And Slackware too:
Thu Oct 22 23:04:17 UTC 2026
patches/packages/linux-5.15.223/kernel-generic-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-headers-5.15.223-x86-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-huge-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-modules-5.15.223-x86_64-1.txz: Upgraded.
patches/packages/linux-5.15.223/kernel-source-5.15.223-noarch-1.txz: Upgraded.
This update fixes bugs and security issues, including the PwnEscape flaw.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-99999
(* Security fix *)
Reminder that Ubuntu used to bundle spyware - I dropped it at that point and never looked back, trust broken.
Ubuntu seems like it hasn’t been in very good hands for quite a while now
I genuinely want to understand why people use Ubuntu, and especially for servers. I’m not trolling or whatever the proper word for it. It’s not sarcasm either. I must be missing something, I guess. What is the reason? Especially if you’re not paying for it. But if you’re paying for it, I’m still curious.
Given that Ubuntu is downstream from Debian, I can't think of a single good reason why Ubuntu wouldn't just release Debian's patch.
From the same company that demands high school transcripts and club affiliations for engineers 20+ years out of high school.
Creepy as hell company. Had a good free Linux distro, but it's not that good anymore. It's coasting on inertia these days.
OpenBSD got a recent GeFS (COW FS, but far lighter than BTRFS and not to mention ZFS) update, I wish 8.1 or 8.2 had it stabilized, because the issues with FFSv2 would end in the spot and maybe even steal some server machines to GNU/Linux.
There seems to be something off about this post. One hour in and hundreds of comments.
Either this was used to pop something big, or this is a jia tan situation going down.
I thought there was a flamebait automation that was prevent this sort of velocity (unless overridden)
Yes, this is a fuckup by Canonical
But it doesn't sound too hard to backport a patch from Debian to Ubuntu yourself.
So if it's a critical security concern to your company, open your laptop and get to work.
> distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix.
Well - Ubuntu sold out to marketing rather than engineering.
Happened to Google too. Compare Google Search to 10 or 15 years ago. Totally useless nowadays.
I mean.. how many people are using multipath on Ubuntu? This is a big issue for datacenter systems that are using fancy networking features that Ubuntu users probably aren't.
This turnaround time is appalling, especially given that Debian shipped a fix weeks ago. Poor show, Canonical.
Honestly, I agree. I need to provision a new VPS for a personal site and I’m holding off until it’s resolved.
Not to mention however many production services teams I work with build and maintain that run on Ubuntu.
Ubuntu are dragging their feet and it’s not good enough. Nowhere near good enough.
Get it patched NOW!
And if you’re on here and you work for Ubuntu, then what the hell are you doing reading this when you should be shipping a patch?
Seriously: get on it, will you?
I've all but stopped using traditional "Linux distributions" honestly.
i would then give claude/codex full access, and ask it to do a temp patch, if they allow lol.
Debian is, in every way that I know, superior to Ubuntu.
- no snap nonsense where you can't turn off upgrades
- stays close to upstream LTS kernels
- does not carry around some ridiculous kernel patch set
- no irritating adware on login
> and I considered it the solid, no-drama LTS distro. Fuck that now.
There's been lots of drama on Ubuntu which OP either completely missed or ignored. Ubuntu has been getting worse for over a decade now.
Everyone is just using Ubuntu for free of charge for the most part. You get what you pay for.
On another note, you can probably easily install the Debian kernel onto your machine.
"But we need signed kernels!" Well, that's a big "I told you so" from the people that were against only a handful of distros being able to create signed kernels with MS derived keys like 15 years ago.
[dead]
[dead]
[dead]
[dead]
[dead]
Withholding security-critical open source contributions to collect subscriptions is really low.
Bye Ubuntu