Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

Original Article ↗ Hacker News Discussion ↗

Ubuntu is under fire for taking nearly three weeks to ship stable kernel patches for a critical Linux remote code execution vulnerability (CVE-2026-98432), even as other major distributions have already released fixes. Commenters weigh the trade-off between Canonical’s slower, more heavily tested release process and the heightened risk and bad optics around an actively publicized network-exploitable bug, sharing interim mitigations such as iptables/nftables rules and concerns about unpatched consumer routers. The episode is prompting some administrators to reconsider Ubuntu in favor of Debian or other systems and has revived criticism of Canonical’s communication, while also highlighting skepticism about Freenode.net as a source given its controversial ownership.

Ubuntu’s delayed patch and process

  • Many are frustrated that Ubuntu’s LTS kernels remained unpatched for weeks while other distros (e.g., RHEL, Debian, Gentoo, MikroTik, OpenWRT) shipped fixes.
  • Ubuntu has fixes in the “proposed” pocket, but these reportedly introduce regressions for some flavors, which may explain caution.
  • Some argue Ubuntu’s many kernel variants and need for broad testing justify slower rollout; others see bureaucracy and “governance types” as blockers.
  • Lack of clear, proactive communication from Ubuntu is a recurring complaint.

Mitigation strategies and limitations

  • Multiple comments share iptables/nftables rules to drop IPv4 TCP packets with IP options (in raw PREROUTING), or to block ingress/egress with options generally.
  • Disabling MPTCP is discussed as another mitigation.
  • RHEL and others explicitly state these measures only “reduce exposure,” can’t fully prevent exploitation.
  • Reasons discussed: local malicious processes, chained exploits (app-level RCE → kernel RCE via loopback), eBPF bypassing netfilter, separate network namespaces (containers, Firejail).
  • Default “deny all incoming” firewalls do not inherently fix this, since the bug is in TCP connection handling before typical filter rules.

Exploitability and real‑world risk

  • Some admins with many unpatched servers report no observed attacks and view the risk as overblown, citing the bug’s narrow race condition and rare use of IP options.
  • Others counter that lack of visible incidents doesn’t prove safety, referencing previous worms that appeared only after some delay.
  • Honeypot and packet-count anecdotes suggest very few IP-options packets in the wild, but data is anecdotal and incomplete.

Impact on distro choice and trust

  • Several users say this incident is enough to move future deployments from Ubuntu to Debian or other distros, seeing volunteers outperforming a commercial vendor.
  • Others respond that many complainers don’t pay Ubuntu and expectations may be mismatched.

Freenode.net as a source

  • Multiple comments warn that freenode.net, post–hostile takeover, is no longer the community IRC network and is viewed as hostile to open source.
  • Some are surprised HN links to it at all and recommend treating it as an untrusted, biased source.

Routers, IoT, and alternative platforms

  • Concern that most consumer routers/APs run unpatched, ancient Linux kernels with minimal firmware updates.
  • Mitigations include using OpenWRT, Turris, MikroTik, ISP-managed updates, or running a custom router (e.g., Debian or BSD-based).
  • Some argue specialized network OSes and HardenedBSD/FreeBSD deployments show Linux is not always the best kernel for high-value targets.