WTF Ubuntu?
- ID
- 42074
- Status
- summarized
- Published
- 02 Nov 2026, 10:52 PM
- Fetched
- 03 Nov 2026, 1:29 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://chalmovsky.com/posts/wtf-ubuntu
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.5
- Created
- 03 Nov 2026, 1:29 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
A blog post argues that CVE-2026-98432 — a CVSS 9.8 remote, root-level flaw in Linux kernel TCP code present since 2016 — was patched by Debian on October 16, while Ubuntu still listed every supported release, LTS included, as "Vulnerable" more than two weeks later, nine days after the 9.8 rating and six days after Anthropic reportedly produced a working root exploit. The author says they took their Ubuntu servers offline because they had no time to migrate, and is moving off Ubuntu entirely, contrasting Canonical's "timely patches" and "enterprise-grade" marketing with volunteer-run Debian, Arch and Alpine having shipped fixes. The post drew 580 points and 285 comments on Hacker News.
Why it matters
If you run Ubuntu on VPS instances — the default at most providers — this is a concrete prompt to check your own hosts against Ubuntu's per-release CVE tracker instead of the marketing page, and to decide now whether you mitigate (restrict exposure on the affected TCP path), accept the risk, or migrate, rather than discovering the gap mid-incident. It also undercuts the assumption that a paid security subscription like Ubuntu Pro buys faster patching than free distros; the post's comparison is Debian patched Oct 16 vs. Ubuntu still unpatched on Nov 2. Treat it as one author's account and verify the patch status yourself before acting.
Discussion angle
How fast could you inventory and patch every host you run if a working remote-root exploit existed today — and does your choice of base image come with a patch-latency assumption you have never actually measured?