https://ubuntu.com/security/CVE-2026-98432
I've had mitigations in place for a week, but this response is really shaking my confidence in Ubuntu. I'm just trying to understand what is going on with Ubuntu. Do they have too many kernels (that page is loooong), do they not have enough automation in the build/test pipeline, are their engineers overwhelmed?
We are moving into a world where there are going to be vastly more security issues; if you can't keep up now, where are you going to be in the next 6 months?
For a long time keeping on top of OS updates has been a huge part of keeping the attackers at bay. However, the world is changing.
* https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...
The fixes were in the "proposed" repo since October 26 (noble) and 28 (resolute):
* https://launchpad.net/ubuntu/+source/linux
One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at:
* https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
The kernels goes through an QA testing processes, and per this September post, they're looking at shortening the timeframe for kernel updates:
* https://canonical.com/blog/accelerating-delivery-of-cve-fixe...
Looks like they aren't flexible enough to get a 4-line fix out the door when they need to.
These situations need a CEO or other high up to pull some people into a room, and basically say, "this needs to be released by EOD."
Perhaps because Ubuntu, like most distros, release new kernels that include fixes and updates for more than one issue:
* https://access.redhat.com/errata/RHSA-2026:93413
* https://launchpad.net/ubuntu/+source/linux/6.8.0-149.149
* https://www.suse.com/support/update/announcement/2026/suse-s...
* https://security-tracker.debian.org/tracker/DSA-6568-1
A lot of people don't reboot their systems. They build new ones, shift workloads and traffic over, and decommission the old ones. I can do that multiple times a day if required with no disruption of services.
You don't have to stay patched if you judge the risk doesn't make it worth it, but Ubuntu is pretty much the only distro that made the choice for you.
You are expecting some quality that was never there. Visibly so.
Ubuntu should be your last choice.
I don't hate Ubuntu at all, but that incident showed a level of blithe carelessness to user data that is unacceptable and reduced my confidence in them.
At least 15 years of nonsense.
In general I find distros using old kernels annoying because Linus treats compatibility seriously and “don’t break use space” has been a mantra for many years. On desktops in particular, GPU driver improvements like https://www.phoronix.com/news/Linux-7.3-DRM make it super worthwhile.
As for exactly which distro, it matters less than you think. I use openSUSE Tumbleweed but plenty of my friends prefer Arch.
This doesn't seem to be popular with linux though. It's one thing I like about FreeBSD, everything is easy to keep very bleeding edge.
Maybe Debian 'testing'?, is that commonly run in prod?
> This doesn't seem to be popular with linux though.
Nobody ever got fired for buying IBM.
Nobody ever got fired for choosing Java.
Nobody ever got fired for choosing Debian.
It's a bandwagon effect. Though, it can also be a matter of common familiarity if you're not the only admin.
There is a balance: too outdated is bad, too eager for new versions is bad. The tradeoff that LTS tries to take is older, proven versions but with relevant security fixes quickly.
Well, I do use Arch on a lot of my VMs but still.
for something more serious than a personal project, I'd go with Debian because of their vast free support windows and some incredible companies providing extended support
However, since I run a VPS host most of my customers run Debian or Ubuntu, due to both being more approachable than RPM-based distros.
I'm not a huge Ubuntu fan due to it being a very heavy downstream of Debian, versus Rocky which is 99.9% RHEL. I hold no grudge against Ubuntu, they made desktop Linux very approachable when Mandriva, Knoppix, et al. weren't.
But Canonical is too much of a downstream versus Red Hat, constantly losing standards wars. And unlike BSD (where I can understand) Canonical is a downstream by choice. It's like Sony who keeps losing standards wars to rivals.
Even in my homelab EVE-NG runs on Ubuntu.
People are saying Debian. What are the tradeoffs? (other than faster patching on Debian of course)
Older packages, but that's one of the reasons I use it. On the stable branch you will only get security fixes and very rarely updates for critical bugs.
If you need to use newer packages the testing branch is surprisingly stable (it is the base for Ubuntu) but there are a lot of updates.
But even basic company tooling like Landscape is not doing great (Oh, look, all your machines are not fully patched 5 minutes after we released a patch. Sound the alarms)
Meanwhile, they spend a lot of effort on things that ultimately not gain traction. Upstart or snap might be technically OK, but socially they are dead ends. Half baked Rust coreutils in an LTS? Who asked for that?
I've seen multiple major CVEs and showstopper bugs just sit there, while Debian and Red Hat move weeks faster than them, and other individuals and big companies providing ppas with workarounds.
I like the company, but some major bigwigs over there need to wake up.
I agree though, this took too long.
https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/
WTF Ubuntu?
https://news.ycombinator.com/item?id=50337608
https://news.ycombinator.com/item?id=50348688
Or install newest mainline test kernel, but it had less testing, YMMV:
https://news.ycombinator.com/item?id=50358616
43: https://bodhi.fedoraproject.org/updates/FEDORA-2026-bc7bd292...
44: https://bodhi.fedoraproject.org/updates/FEDORA-2026-7b153c4c...
Fedora 45 was only just recently release and Fedora 42 and earlier will never get an official patch since those are no longer maintained.
A patch containing a new feature which tangentially fixes a security issue is merged to mainline. It will not get merged into stable or LTS (by definition).
Since October 26 (noble) and 28 (resolute), when the kernel versions in question hit "proposed". November 2 is just the weblog post, but the solution was available the week before.
What i just described isn't a joke or an exaggeration either. It's literally part of the application process and you can look this up.
Anyway they are quite simply hopelessly mismanaged and no one should be touching Canonical products at this point.
IME, because of pay, they have a hard time retaining "senior" talent, eg Nvidia, Chainguard, Amutable, Lambda, etc etc etc all have lots and lots of senior+ Canonical engineers. Especially in the age of AI, I think this is a "people-strategy" mistake.
The application process is very long and you absolutely lose great candidates because of it. Salaries are not US-tech competitive, but absolutely are Central/South America and Europe competitive. Lots of great Brazilian and Polish engineers, for example.
Also I have never seen a post on HN, Reddit etc about Canonical/Ubuntu that doesn't complain about hiring process. I think it does a pretty incredible amount of damage to the brand.
How well did you and your colleagues do at math in high school?
> Salaries are not US-tech competitive, but absolutely are Central/South America and Europe competitive.
Don't their salary bands change between countries? They're offering 55k-ish to a Senior SWE in France, which is a low-ball offer even there.
Sounds like they do when they get the chance. I've worked for a company that didn't have quite as crazy a hiring process but they had the same basic profile - very good at hiring for potential in juniors, but underpaid for the ability they wanted. As a result they really struggle to hire seniors and are often a stepping stone to a better paid position. They do manage to keep some people until retirement, though (a very bimodal distribution - generally either brilliant but don't care to work anywhere else, or utterly useless and can't get a job anywhere else)
I don't know anyone at canonical personally, so I have no specific opinion. However. This smells like the same bullshit peddled by any tech company's hiring policy but executed less competently.
Made me happy I was cut loose early.
I do think there is a large connection between grade performance/SAT scores and general aptitude and success later in life. But as you said there are plenty of circumstances that would lead to poor grades that aren't related to ability - but I would also say those circumstances are also possible indicators of how good of an employee you will be. For example having behavioral problems as a kid could lead to bad grades despite otherwise capable of good grades, and I would suspect there's connection between childhood behavioral problems and conduct as an adult.
I've worked for one of these businesses before - basically staffing a daycare running a very compelling roleplay scenario so a millionaire/billionaire has an excuse to get away from their family for 10 hours a day. It works best if you're a fresh grad college kid who doesn't realize any of that for a few years and is just glad to have gotten a job.
So, the actual intent of all of their hiring circus is to ensure they don't accidentally hire someone who realizes what's going on.
EDIT: I'm shocked.
They ask for; A massive multi-choice questionaire. A massive free form list of questions. An ask for an essay. Grades from High school through to University. That's to start the process of many rounds of interviews followed by finally an interview with Mark Shuttleworth himself who's known to say no on vibes.
Personally i applied for a senior management role after ~30years working at multiple other very large and well known companies. The pay at canonical was literally 1/5th but i was curious. I was honest about my high school scores and immediately given a thanks for your time but we will pass dialog on their website after stating maths scores in year 9. I'm not even fucking kidding. Obviously i was gobsmacked. It was a blessing to get knocked back that early all things considered.
Not my post but has more detail and matches what i saw. Be amazed at the insanity in the leadership at Canonical that allows for this; https://www.reddit.com/r/recruitinghell/comments/15kj845/can...
We're talking put him in a straightjacket loony tunes type of shit when it comes to Shuttleworth. You can also look up various personal interactions. It's utterly fucking insane.
What sort of answer are they looking for here?
The knockback didn't hurt. It just made me think Canonical was lead by a lunatic and a quick Google will confirm this.
The reason more companies don't use IQ tests is that they don't work well for candidate qualification. Also, candidates hate them.
Epic actually did (does?) administer a full blown "entrance exam" - generic problem solving skills, with some basic coding and math stuff. They literally arrange with the university to administer it in a classroom setting. So yeah, kind of like an aptitude test.
See https://pigment.is/blogs/blogs/epic-systems-skills-assessmen...
I actually don't mind that, as it ensures all applicants are being judged on a level field.
It's quite rare for people graduating with a BS to be quizzed about SAT scores - the focus tends to be more on GPA, etc. But asking for SAT scores when you've been in grad school for so long...? Kind of ridiculous. And if you are going to ask, might as well ask for the GRE scores instead.
They also did (do?) a full personality quiz. You know, the type where they give you a scenario, and say are you more of A or B, and you often find yourself to be neither or both...
"Nah, let's not build up our technical street cred by doing stuff right, we'll torpedo that by making bizarre aspects of our culture stick in people's minds. Success!"
And just for full disclosure, I've never applied or have went through their process, all I know about it is second-hand through comments like these. It's just a terrible look to have that be what people think about your company.
In high school (in Australia), I went to Year 7 and 8 at one school, and did not do well (ADHD+"gifted"), and spent most of my time, it felt, in detentions, etc.
Moved to another school. Half a term of Year 9 and I was in 10. By the second week of second term I was in Year 11, and went on from there, graduating effectively 2 years early.
Canonical recruiter: "So you don't have any Year 9 grades to share? Or Year 10? Hmm, I'm not sure how we handle that, as we want to know those."
"Amusingly", when I went to do paramedic studies at a Community College in the US, high school graduation was required. Because my high school was overseas, they had to use a "translation service" to validate that my Australian high school graduation was "educationally equivalent" to the US. Never mind that whether or not it was (and I'd argue it was superior), "What about the fact that I have a B.S. (Hons)?". "Sorry, School of Health rules says we need this document for admission". (I got in, but the delays meant I had to wait until the next intake).
The good thing was a LOT of bugs were fixed in those 2 months. Also you can install or upgrade to U+1, so you could've upgraded in april.
Back when I used arch last they didn't have `archinstall` which made it just as easy as anything else to configure. Arch wiki is still a great resource. Wasted a lot of time trying out desktops just to land back at gnome. Genuinely can't believe how bad Cosmic DE is after all this time. I should be nicer about that, but I'm willing to elaborate if anyone from Pop is here, no ill will.
I have a... potentially false sense of security now that I'm on a distribution that can keep up with all of this CVS madness. I wonder if it's not just the best way to do it going forward. We'll see, it could be so if things go the way Greg Kroah-Hartman supposes they will; that LLMs are just like when fuzzers were new, and the issues will gradually reduce over time.
Ubuntu Pro provides security updates for packages that wouldn't otherwise be supported by Canonical at a given point in time. If your version of Ubuntu is still within the (non-extended) support period, kernel security updates are always provided regardless of Pro.
If you rely on Ubuntu, move to Debian.