https://access.redhat.com/security/vulnerabilities/RHSB-2026... - "Ongoing"
I chose AlmaLinux last time I needed to, and it's been a great way to access the ecosystem — I heartily recommend it as a free RHEL! — but these past few days have me looking in envy at Debian. Corporate stability hasn't been what I expected.
I had to fall back patching, repackaging and maintaining multiple times while waiting sometimes weeks them to issue fixed packages. I don't know what happened to Red Hat over the years, already before IBM purchased them. But they became too slow on this kind of issues.
Debian consistently provided fixes quickly next day at least and I never had any issues upgrades since from 7 to 12, when I retired. Only reason to do complete reinstall was that ext3 and ext4 disk formats had improvements, which made life bit easier with 64bit systems.
ps. No problems from 12 to 13 any more with my own systems at home.
Ubuntu (including Ubuntu Pro) still doesn't have a CVE-2026-99999 patch while Debian does have it. For commercial operators a KVM guest escape vulnerability is quite important.
And I don't put a lot of faith in container scans as a metrics. (More properly, I don't have faith in most containers scanners to properly identify package versions and backports.)
We pay good money for their highest support tier and they are almost always the latest to bring a needed update.
Can't exactly remember what it was but it has happened before. It's a shame.