Hacker News new | past | comments | ask | show | jobs | submit
swinglock | on: TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
How are Ubuntu and RHEL not fixed? Few operating systems market themselves more as suitable for servers. What are they doing over there?
kev009 | parent | next
If you read commit logs of, say kernel.org and a distro kernel, and aren't concerned you are blissfully ignorant (and it is worse for the broader userland repos). It's particularly bad when they don't track a kernel.org LTS. Their kernel orgs are pretty lean and this has been the status quo for decades. CVEs of sufficient stature like this will get fixed but majority of other issues slip by unnoticed. LTS is kind of a myth, it trades ABI and API stability for a lot of other issues.
SwellJoe | root | parent | next
"Their kernel orgs are pretty lean"

For years, Red Hat employed more kernel developers than anyone and contributed more. These days they're "only" the fourth largest contributor, after Intel, Google, and Meta, but they are still among the largest corporate contributors.

If that's a lean kernel org, I don't know what a fat one would look like.

kev009 | root | parent
My hearsay, from friends and colleagues that work(ed) there, is that the shipped product is not really where you see these "heavy hitters".. a lot of the maintenance happens offshore.
lmz | root | parent
Just makes sense that they would put the "heavy hitters" on feature development, not backporting security patches.
radlad | root | parent | next
Unfortunately, as a ZFS on Linux user, LTS is the best way to get continual updates without breaking my system.
Gigachad | root | parent
Probably best to not leave any ZFS system connected to the internet then.
loading story #50323028
icedchai | root | parent
Over the past few months I've started to install newer ubuntu kernels using the mainline PPA. However, it goes long periods of time without getting updates, so it's not really a satisfactory solution. In one case I just built the kernel myself.

LTS doesn't work if you want immediate fixes like the current environment requires.

gadtfly | parent | next
Given the current and rapidly upcoming environment, would that not imply that those are no longer viable choices? As like a fairly urgent emergency consideration?

If they cannot demonstate being systematically able to adapt towards the required reaction time (minutes? hours?) by almost-comically many orders of magnitude (multiple weeks), and it is only going to get worse, then what other conclusion could there be?

Like they'll only organizationally adapt when it's far too late (everybody using their shit has already been pwned), and then it'll be an unpracticed emergency adaptation.

throw0101d | parent | next
> How are Ubuntu and RHEL not fixed?

Ubuntu has had kernels in the "proposed" component for several days now if you want to pull it in manually. Not yet pushed to "security" or "updates".

loading story #50320889
Shank | parent | next
I’m pretty confused because apparently Anthropic is the group that followed “responsible disclosure” but apparently even though upstream was patched a couple weeks ago, still nothing on either.
kqgnkqgn | parent | next
It seems particularly crazy for Ubuntu given that Debian released their fix something like a couple weeks ago.
loading story #50321226
loading story #50323335
xorcist | parent | next
It's one of two things: Either they have found some regression with enterprise customers, or they are not happy with the fix.

RHEL runs with MP-TCP disabled by default, they initially listed it as Important only to later raise it to Critical.

ashleyn | parent | next
I don't think I can recall an instance where there was an issue this bad (a box being vulnerable just by virtue of being connected to the internet, or exposing nothing other than ssh) and I didn't have timely patches for it. I had to turn off my server and home automation system because of this. Really not acceptable at all and makes me want to switch everything to debian.
Flockster | parent | next
Going by the proxmox forum the fix is already in the sources (proxmox released their kernel based on them a few days ago). But I could not see, if it is already released for the users.

https://forum.proxmox.com/threads/cve-2026-98432-in-proxmox-...

loading story #50320015
1over137 | parent | next
>How are Ubuntu and RHEL not fixed?

IMNSHO this makes them unfit for purpose. I think this is the nail in the coffin for Ubuntu for me.

loading story #50321108
roygbiv2 | root | parent
What would you suggest for enterprise use of Linux if RHEL is no longer fit for purpose?
loading story #50321963
lakeviewterrace | parent | next
Running regression tests I assume; they can't just YOLO shit like most OSS projects for the exact reason you mention.
loading story #50320922
loading story #50319875
| parent
{"deleted":true,"id":50320269,"parent":50319570,"time":1793480980,"type":"comment"}