Hacker News Reader

Comment by infamouscow | Hacker News Reader

This is a problem with LTS distro kernels in general. You're trading the feeling of stability at the kernel level for security updates.

View on HN

This is not a problem with Debian LTS, you’re getting timely security updates. Debian fixed this vulnerability three weeks ago within two days: https://www.debian.org/lts/security/

Ubuntu is the only Linux distro with an LTS release that has not patched this issue, so saying this is a problem with LTS distro kernels in general is categorically false.

A large number of security issues are not backported to stable or LTS kernels.

A patch containing a new feature which tangentially fixes a security issue is merged to mainline. It will not get merged into stable or LTS (by definition).

To the extent that you've made specific claims, they are false. It's hard to argue with vague claims about tangentially fixing a security issue but at any rate just looking over LTS releases, they absolutely and frequently do backport security issues to LTS releases. They don't do it for every security issue, but the idea that they rarely do it or only do it as part of a tangential change is once again... categorically false.

Fedora took over two weeks to get a patch out too afaik

Fedora doesn't do LTS releases, but they released the patched kernel two days before the CVE was publicly announced:

43: https://bodhi.fedoraproject.org/updates/FEDORA-2026-bc7bd292...

44: https://bodhi.fedoraproject.org/updates/FEDORA-2026-7b153c4c...

Fedora 45 was only just recently release and Fedora 42 and earlier will never get an official patch since those are no longer maintained.

LTS distros can track the LTS kernels and they’ve all been updated

For Ubuntu it was _all_ their kernels though...

Reply on news.ycombinator.com