That feeling when Debian is more up-to-date than you....
this post was submitted on 02 Nov 2026
78 points (97.6% liked)
Linux
68515 readers
617 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
canonical takes ages to ship patches sometimes, not just with security vulns. it's part of the reason i hopped away.
There's also no livepatches from Ubuntu Pro, and I thought this was the whole idea of livepatches, to patch critical bugs before you have a chance to update the kernel.
This also isn't the first time I've been annoyed at Ubuntu's response time. Luckily I mostly run Debian, but I certainly won't be using Ubuntu for anything else in the future.
Context from the article for those that don’t like clicking ..
Debian patched it on October 16. Ubuntu still doesn't have a patch more than two weeks later. Every supported release, LTS included, is listed as "Vulnerable".
Ubuntu hasn't shipped the patch nine days after it was rated 9.8 and six days after a working root exploit.
you do know you can just put a firewall rule in to prevent any IP options from hitting the server
The rule (matches header length > 20 bytes, i.e. IHL 6–15):
iptables -I INPUT 1 -m u32 --u32 "0>>24&0x0F=6:15" -m comment --comment ipopts-stopgap -j DROP
- ufw: add
-A ufw-before-input -m u32 --u32 "0>>24&0x0F=6:15" -j DROPto/etc/ufw/before.rules, above theRELATED,ESTABLISHEDaccept line. Then runufw reload. - csf: put the iptables line in
/usr/local/csf/bin/csfpre.shso it survives csf restarts. - Docker hosts: use
-t raw -I PREROUTINGinstead, so container traffic is covered too.
Test: run ping -R at the box and watch the counter go up in iptables -L INPUT -v -n. Note that many networks drop option packets in transit, so test from the same LAN or a local netns.
its a stopgap. not a fix. but you don't have to take all your servers offline ..... just put the block in and wait for the patch
ok gpt
Do you also have a nftables rule?
It's not really a 9.8
It's ridiculous, every time they abuse the cvss system like this people become less likely to actually address vulnerabilities.
I don't think anyone will ever exploit this in the wild
Apparently ubuntu is for the latest features, not the latest security fixes, for those you need debian to be updated at the highest pace
It's pretty bad...