Hacker News
points by throw0101c 1 day ago | 0 comments
As outlined in this weblog post:

* https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...

The fixes were in the "proposed" repo since October 26 (noble) and 28 (resolute):

* https://launchpad.net/ubuntu/+source/linux

One could pull them down at any point in the last week. Yesterday afternoon they were still in "proposed", but I checked this morning (EST/UTC-5) and they there were in "updates". Some tracking of timeline of when the updates to the repos happened seems to be available at:

* https://ma.ttias.be/linux-cve-2026-98432-vulnerable-kernels/

The kernels goes through an QA testing processes, and per this September post, they're looking at shortening the timeframe for kernel updates:

* https://canonical.com/blog/accelerating-delivery-of-cve-fixe...

[–] gwbas1c 1 day ago
> The kernels goes through an QA testing processes, and per this September post, they're looking at shortening the timeframe for kernel updates:

Looks like they aren't flexible enough to get a 4-line fix out the door when they need to.

These situations need a CEO or other high up to pull some people into a room, and basically say, "this needs to be released by EOD."

[–] throw0101c 1 day ago
> Looks like they aren't flexible enough to get a 4-line fix out the door when they need to.

Perhaps because Ubuntu, like most distros, release new kernels that include fixes and updates for more than one issue:

* https://access.redhat.com/errata/RHSA-2026:93413

* https://launchpad.net/ubuntu/+source/linux/6.8.0-149.149

* https://www.suse.com/support/update/announcement/2026/suse-s...

* https://security-tracker.debian.org/tracker/DSA-6568-1

[–] cassianoleal 1 day ago
Perhaps that's the problem? Surely they use a version control system that allows them to branch off of older commit for these kinds of urgent patches.
[–] throw0101c 1 day ago
So distros should release a new kernel for each CVE? Or only the "important" CVEs? And if two "important" ones come out two days apart there should be two kernels running through the QA pipeline? So that people can reboot their production systems two days apart?
[–] mjhay 1 day ago
Timely security updates are important. Debian LTS had the patch within a couple days. It’s not like you have to update if you don’t want to.
[–] cassianoleal 19 hours ago
> So that people can reboot their production systems two days apart?

A lot of people don't reboot their systems. They build new ones, shift workloads and traffic over, and decommission the old ones. I can do that multiple times a day if required with no disruption of services.

You don't have to stay patched if you judge the risk doesn't make it worth it, but Ubuntu is pretty much the only distro that made the choice for you.

[–] fauchletenerum 1 day ago
No, just the ones rated 9 or higher
[–] eptcyka 1 day ago
Yes.
[–] reverius42 1 day ago
Yes, if two 9.8 kernel CVEs come out two days apart, then yes, everyone should be rebooting their prod systems two days apart.