Here is Ubuntu’s webpage on this vulnerability:

https://ubuntu.com/security/CVE-2026-98432

It’s still, over a week after disclosure and patches, unpatched in Ubuntu.

As for me, a part of me wants to move over to Rocky Linux 10.

▲ perlgeek 32 minutes ago | parent | next [-]

I don't quite understand this page. I thought the kernel binary was in the `linux-image-` packages in Ubuntu.

For example, I have linux-image-generic installed, description "Generic Linux kernel image This package will always depend on the latest generic kernel image available." and then "Depends: linux-image-6.8.0-147-generic, linux-modules-extra-6.8.0-147-generic, linux-firmware, intel-microcode, amd64-microcode"

Why isn't there linux-image or linux-modules-* listed as an affected package?

First I thought it was the source package / binary package distinction, but e.g. linux-image-7.0.0-38-generic says "Source: linux-signed-hwe-7.0", and linux-signed-hwe-7.0 isn't listed as an affected package either.

So what's going on here?

▲ vanschelven 4 hours ago | parent | prev | next [-]

Yeah that literally is in "does not compute" territory for me. That page literally opens with "Ubuntu priority High [..] 9.8 · Critical [..] Publication date 15 October 2026 [..] Last updated 30 October 2026" which is exactly why "WTF Ubuntu" is the right response here.

▲ pixelesque 4 hours ago | parent | prev | next [-]

> Rocky Linux 10

Does Rocky use their own community-built packages, or does it use RHEL's?

Because I don't think Red Hat have released patches yet either?

▲ strenholme 4 hours ago | parent [-]

It’s fixed in RedHat:

https://access.redhat.com/security/cve/cve-2026-98432

For RedHat/Rocky 10:

https://access.redhat.com/errata/RHSA-2026:93413

Also, a mitigation:

https://access.redhat.com/security/vulnerabilities/RHSB-2026...

	▲	strenholme 2 hours ago \| parent [-]
		It isn’t quite in RockyLinux yet, but Rocky has a special security repo for getting updates quicker than the RHEL → Rocky security update path: `sudo dnf --enablerepo=security update` (This command is run every time one needs an urgent security fix right now when using Rocky Linux) Reboot to have the new kernel This is how to get the patched kernel right now if running Rocky Linux. Here is the patched kernel (`rpm -qa \| grep kernel-6`) `kernel-6.12.0-211.69.1.el10_2.x86_64` More information: https://rockylinux.org/news/2026-05-14-introducing-security-... https://forums.rockylinux.org/t/cve-2026-98432-any-roadmap/2...

▲ whalesalad 4 hours ago | parent | prev [-]

14.04 LTS trusty is not vulnerable fyi.

▲

ASalazarMX 2 hours ago | parent [-]

And only a measly 12 years behind! People that didn't migrate their systems to python 3 are in for a treat.

▲

jeroenhd 2 hours ago | parent [-]

Canonical still maintains it. If you're just hosting some HTML or even PHP, you have a comfortable amount of time before you need to upgrade, assuming you're a paying customer.

	▲	ASalazarMX an hour ago \| parent [-]
		I jest, but we had (HAD) an Ubuntu 18.04 LTS that received the backported patch for PHP2Shell, even if the version wasn't supported officially by PHP. This is why I insist our developers use the Ubuntu repositories instead the official PHP ones: besides possible instability, PHP doesn't do ancient backports.