For 15 years or so, I used and recommended Ubuntu. But this is unacceptable and I won't be looking back.
So just as they made it popular, they can make it unpopular. People like me will simply post on our blogs and social media that they should not install Ubuntu. A typical Ubuntu user is not that high on the tech scale, and they listen to people like me for suggestions on which distro.
Cut the pipeline that feeds into it.
Use this firewall rule and you are fine - it blocks the tcp options negoation - and things remain working of course: ` nft add table ip cve_2026_98432 nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }' nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop `
For me, I view Ubuntu as the "higher quality, more mature distro" which I value over "purity".
There is a reason I moved to Debian; it is not like I just like the sound of it better.
My view is based on having used Ubuntu since 2006, Kubuntu since 2023 or so and a serious stint on Debian until they put out a patch via regular updates that bricked my machine's wifi (all of them). So my view is based on real world experience and your comment "Your view does not seem to match reality" doesn't seem to take my experience with Ubuntu and Debian into account.
I still haven't done this for my servers with SOC2 compliance (for obvious reasons), but I've moved over my personal project servers to this pattern. They all run ubuntu and this CVE was fixed within 1hr of my agent seeing chatter on twitter about it.
Still in the testing phase of this pattern, but while I initially thought it'd be a terrible idea[1], I'm coming around to it more and more with the amount of major CVEs hitting.
I suppose this kind of stuff is why you will find some places who roll Debian in prod but almost never find Ubuntu?
on laptops etc. its less impwct because (i think) most people are sensible enough not to have all kinds of listeners open all the time?/(right guys??? ...RIGHT GUYS???)
dont forget it can also be used as LPE if its a local host listener. and LLMs can bake u a nice exploit for it too.
Go Debian or perhaps consider freeBSD or OpenBSD if your workloads permit. they are more feasible, and sensible by the day, not just trying to poop on Linux, its simply much more targeted for now, and because it moves faster, and thus is bigger, it will have more holes.
a lot of ball dropping all around lately in lots of incidents and CVE. stay safe out there!