For years, Red Hat employed more kernel developers than anyone and contributed more. These days they're "only" the fourth largest contributor, after Intel, Google, and Meta, but they are still among the largest corporate contributors.
If that's a lean kernel org, I don't know what a fat one would look like.
LTS doesn't work if you want immediate fixes like the current environment requires.
If they cannot demonstate being systematically able to adapt towards the required reaction time (minutes? hours?) by almost-comically many orders of magnitude (multiple weeks), and it is only going to get worse, then what other conclusion could there be?
Like they'll only organizationally adapt when it's far too late (everybody using their shit has already been pwned), and then it'll be an unpracticed emergency adaptation.
Ubuntu has had kernels in the "proposed" component for several days now if you want to pull it in manually. Not yet pushed to "security" or "updates".
https://ubuntu.com/project/docs/SRU/reference/sru-verificati...
or download the individual package (and dpkg --install ... but this doesn't check signatures)
https://ubuntu.pkgs.org/26.04/ubuntu-proposed-main-amd64/lin...
Don't trust Ubuntu's LTS promises, either. Most of the modern packages you care about are in universe, which almost never gets patched after the initial release.
I think they deliberately leave the free LTS version insecure in order to sell Pro licenses. But guess what, even Pro doesn't get timely patches.
RHEL runs with MP-TCP disabled by default, they initially listed it as Important only to later raise it to Critical.
https://forum.proxmox.com/threads/cve-2026-98432-in-proxmox-...
It went through internal QA and to the test soon after that, then a few days later to the no-subscription repository and as of yesterday morning CET it was cleared for the enterprise one, so it's available on all repos of all Products we got in their current supported releases.
For kernel updates we where even more conservative in the past, but with the current churn on often quite relevant fixes picked up the pace a bit on moving them along, trying still to balance rolling out fixes fast(er) while not doing that so fast that tricky (hardware/setup specific) regressions don't get caught.
edit: As this makes the rounds we also released a PSA for it now [0] to make our status here easier to find.
[0]: https://forum.proxmox.com/threads/proxmox-virtual-environmen...
IMNSHO this makes them unfit for purpose. I think this is the nail in the coffin for Ubuntu for me.
I pulled in from -proposed this time.
Ubuntu was slow on the brotli / CVE-2026-111497 updates as well.
No legit enterprise is running that clownware — ever.
Times can change.