upvote

points

by throw0101c5 hours ago |
comments
upvoteby don-code1 hours ago|
next
[-]
I'm not seeing CVE-2026-98432 included in the changelog for any of the new kernels on the 28th.
reply
upvoteby throw0101c45 minutes ago|
parent|
[-]
> I'm not seeing CVE-2026-98432 included in the changelog for any of the new kernels on the 28th.

The versions are mentioned in this page:

* https://ubuntu.com/security/CVE-2026-98432

I'm wondering if the CVE in question is not mentioned because it was embargoed so they did not want to accidentally leak things while the kernel went through the (public?) QA workflow. Perhaps the Changelog will be amended at some point to have the CVE?

reply
upvoteby Avamander3 hours ago|
prev|
next
[-]
> You can pull them down with a "-t" added to your apt-get (but will not appear by default).

How does that look like exactly?

reply
upvoteby throwaranay49331 hours ago|
parent|
[-]
Edit /etc/apt/sources.list.d/ubuntu.sources to include resolute-proposed:

Suites: resolute resolute-updates resolute-backports resolute-proposed

Then update:

sudo apt update -t resolute-proposed sudo apt install linux -t resolute-proposed

reply
upvoteby ASalazarMX3 hours ago|
prev|
[-]
Your comment should be higher. Most indignant comments here are variants of "Tell me you don't know about CVE triage and Linux kernel releases without telling me you don't know about them". I mean, I also don't know a lot about them, but Canonical's security record has been exemplary in my experience, and I see no solid reason to doubt their process in this instance.

First, if this CVE did truly put every Ubuntu machine on the Internet at risk, we'd know about mass compromises by now, and there haven't been any reports. It means the CVE is not trivially exploited.

Second, the gravity of the CVE dictates the security release cycle. Emergency kernel patches carry risks of their own, and it would be worse to hurry a non-critical patch and crash a part of their massive user base.

Edit: I've been enjoying this comment going up and then into the negatives, what a roller coaster.

reply
upvoteby xbar50 minutes ago|
parent|
next
[-]
You suggest that Canonical has concluded that this issue is not so bad and so it is Ok that they have not released a fix.

Customers and users expect alacrity for CVSS 9.8 CVEs in un-hardenable services like the TCP stack.

Whatever Canonical's security record or process has been for other CVEs does not excuse silence and delay in this case. Canonical, unfortunately, does not get to silently decide such a categorized CVE "is not trivially exploited" without criticism, and likely consequences.

reply
upvoteby throw0101c36 minutes ago|
parent|
prev|
[-]
> Your comment should be higher. Most indignant comments here are variants of "Tell me you don't know about CVE triage and Linux kernel releases without telling me you don't know about them".

Ubuntu managed to release the updated 26LTS kernel on October 28, but the other LTSes have been sitting around since 26 or 28, so I'm wondering why they haven't been moved to "security" or "updates" in the several days since.

Especially since their page on it mentions October 15

* https://ubuntu.com/security/CVE-2026-98432

and Debian released a couple of weeks ago.

reply