alt Hacker NewsYour comment should be higher. Most indignant comments here are variants of "Tell me you don't know about CVE triage and Linux kernel releases without telling me you don't know about them". I mean, I also don't know a lot about them, but Canonical's security record has been exemplary in my experience, and I see no solid reason to doubt their process in this instance.
First, if this CVE did truly put every Ubuntu machine on the Internet at risk, we'd know about mass compromises by now, and there haven't been any reports. It means the CVE is not trivially exploited.
Second, the gravity of the CVE dictates the security release cycle. Emergency kernel patches carry risks of their own, and it would be worse to hurry a non-critical patch and crash a part of their massive user base.
Edit: I've been enjoying this comment going up and then into the negatives, what a roller coaster.
Replies
> Your comment should be higher. Most indignant comments here are variants of "Tell me you don't know about CVE triage and Linux kernel releases without telling me you don't know about them".
Ubuntu managed to release the updated 26LTS kernel on October 28, but the other LTSes have been sitting around since 26 or 28, so I'm wondering why they haven't been moved to "security" or "updates" in the several days since.
Especially since their page on it mentions October 15
* https://ubuntu.com/security/CVE-2026-98432
and Debian released a couple of weeks ago.
You suggest that Canonical has concluded that this issue is not so bad and so it is Ok that they have not released a fix.
Customers and users expect alacrity for CVSS 9.8 CVEs in un-hardenable services like the TCP stack.
Whatever Canonical's security record or process has been for other CVEs does not excuse silence and delay in this case. Canonical, unfortunately, does not get to silently decide such a categorized CVE "is not trivially exploited" without criticism, and likely consequences.