See previous discussion and the actual talk on YouTube:
Red Hat disagrees[0][1]. They might be parroting Anthropic, and Anthropic might be exagerating the impact (likely!), but that's the current consensus about the vulnerability. If Ubuntu disagrees, they should have said something and not pasted "Cvss 3 Severity Score 9.8 · Critical" at the top of the page.
> A motivated attacker could probably do this on your network
I find that's still catastrophic given how centralized cloud environments are.
[0] https://access.redhat.com/security/cve/cve-2026-98432
[1] https://access.redhat.com/security/vulnerabilities/RHSB-2026...
It's not like every cloud environment is vulnerable. GCP drops these options for example.
> If Ubuntu disagrees, they should have said something and not pasted "Cvss 3 Severity Score 9.8 · Critical" at the top of the page.
Again I'm going not going to argue they did a good job at pointing at their rationale but it looks like 9.8 is from CVSS 3.0 and they did prioritization with 4.0 which is 8.3. They definitely should have put that up front.
I would be perfectly ok if they had either quietly patched it earlier (like Debian), or communicated their prioritization, or they inexplicably delayed it but provided a high quality advisory (like Red Hat).
I don't like complaining about my fellow security engineers, but this one was real bad and is still personally affecting me.
Exactly. There's room for considered differences of opinion, but that consideration requires discorse and explanation! The lack of communication here is just absolutely baffling. It's like they're deliberately trying to trash their own brand.
I mean, seriously what's going on? We know they have a process for emergency kernel updates, because of course they do. If they're not going to pull the trigger on this particular one (that everyone else is pulling the trigger on) at least make the case.
Given people have demonstrated getting root with it, unlikely seems questionable
> Especially given that the exploit can only be done if packets with IP options. IP options are commonly dropped or removed from packets on the open web.
It sounds like iphones use mptcp in the wild, which use tcp options, so im not sure how true this is.
IP options are annoying in big fast routers because they have to take the slow route via CPU. As there's not a lot of use in accepting packets (externally at least) with IP options, they tend to be dropped totally (but will almost certainly be policed aggressively to the CPU as the CPU is not good for moving many packets).