Ask HN: What in the world is taking Ubuntu so long?
I'm concerned that Ubuntu has marked CVE-2026-98432 as a 9.8 severity but hasn't released a fix for nearly a week, leaving it as "work in progress" with only a mitigation listed. I've had mitigations in place myself, but this slow response is shaking my confidence in Ubuntu. I want to understand what's going on—are there too many kernels, insufficient automation in the build/test pipeline, or overwhelmed engineers? With security issues set to increase dramatically, I worry about the future if they can't keep up now.
Ubuntu's security team is likely overwhelmed by the sheer number of kernel variants they support. Each kernel version requires separate patching and testing, which creates a bottleneck.
The delay might be due to the complexity of the CVE itself. Some vulnerabilities require extensive testing to ensure the fix doesn't break other things, especially in a stable release like Ubuntu.
This is why I switched to a rolling release distro. With Ubuntu, you trade stability for slower security updates, and sometimes that trade-off isn't worth it.