WTF Ubuntu?

Original Article ↗ Hacker News Discussion ↗

Ubuntu’s slow response to a critical Linux kernel vulnerability (CVE‑2026‑98432, rated 9.8/10) has shaken confidence in Canonical’s promise of timely security support, even for paying Ubuntu Pro customers. Commenters note that volunteer‑run distributions like Debian, Arch, Alpine and Slackware shipped patched kernels days earlier, prompting many to consider or begin migrations to Debian, Rocky/Alma, or NixOS for servers and desktops. The exchange also surfaces broader concerns about Canonical’s culture, tooling (Snaps, netplan), and priorities, and highlights stopgap mitigations such as firewall rules while questioning whether enterprise Linux users can still trust Ubuntu for critical infrastructure.

Ubuntu’s handling of CVE-2026-98432

  • Thread centers on frustration that Ubuntu has not shipped stable kernel updates for a high‑score TCP/IP kernel vulnerability weeks after disclosure, while Debian and other distros have.
  • Ubuntu’s own CVE page labels it high/critical, but for a long time listed no mitigation and had confusing/low‑quality package info.
  • Many see this as a breach of Ubuntu’s LTS/security promises, especially given Canonical’s paid Ubuntu Pro offering and recent marketing about “accelerating CVE fixes.”
  • A later Canonical comment says patched kernels are in the -proposed pocket for 22.04+ and that their 2‑week SRU cycle requires extra testing across many kernels; critics argue this is too slow for a network RCE‑class bug.

Severity and exploitability of the bug

  • Anthropic claims a working exploit that gains root via specially crafted TCP packets; some security teams and cloud vendors treat it as serious enough to warrant emergency rules.
  • Others point out that many advisories (e.g., from vendors) emphasize crash/DoS, not clearly demonstrated remote code execution, and an EPSS estimate is low.
  • Disagreement: some argue panic is overblown without a public PoC; others say the combination of remote kernel memory corruption and centralization of cloud infra justifies maximum urgency.

Mitigations and interim fixes

  • Several practical mitigations discussed:
    • Firewall rules (iptables/nftables or Suricata) dropping IPv4 packets with IP options set.
    • Disabling MPTCP was initially suggested but later called incomplete; the bug is about IP options, not strictly MPTCP.
  • Some users built or live‑patched kernels themselves; others pulled kernels from Ubuntu’s -proposed or non‑Ubuntu sources (e.g., Debian, Proxmox).

Ubuntu vs. Debian and other distros

  • Many say this confirms a long‑running view: for servers, plain Debian (or Rocky/Alma, Fedora, NixOS, Alpine, Slackware) is preferable to Ubuntu.
  • Arguments for Debian: faster security response here, simpler/“purer” packaging, no snaps, no Pro nags, long‑term trust.
  • Arguments historically for Ubuntu: better proprietary driver support, predictable LTS cadence, vendor images, ecosystem mindshare, and commercial support; some still defend Ubuntu’s overall track record and emphasize testing burden across many kernels.

Expectations of free vs paid software

  • One camp: “You get what you pay for; free users shouldn’t complain.”
  • Counter‑camp: Canonical markets enterprise‑grade security, charges for Pro, and still didn’t deliver timely patches even to paying customers, so criticism is warranted.

Broader themes

  • Multiple recent CVEs (brotli, PHP, KVM “PwnEscape”) cited as signs major vendors, including Ubuntu and RHEL, are struggling to keep up.
  • Several participants say this incident is their personal tipping point to migrate servers from Ubuntu to Debian or RHEL‑clones, often aided by automation and AI tools.