When the Kernel Beneath Your Vision Therapy Has a 0day, You Stop Sleeping Well at Night 2026-98432 sat on Ubuntu LTS kernels for three weeks. Three weeks. I know because I watched the HN thread grow while our CI pipeline kept pulling base images for the Quest build. We ship Amblyotube — a Meta Quest app that turns YouTube streams into dichoptic vision therapy for amblyopia. Two independent eye buffers, AI-driven MFBF sharpening that detects human silhouettes in real time, a LogMAR staircase screening baked into the onboarding flow, magenta fusion cues rendered at 72 fps so the brain actually fuses the images. All of it runs on Android, which runs on Linux. When the foundation cracks, the whole stack shakes. I remember the night we pushed the 1.4 release. The LogMAR auto-calibration had finally stopped misclassifying moderate cases as mild. The flicker-stimulation parameters felt tuned — not perfect, but honest. Then the CVE dropped. Not in our code. In the kernel we don't control, maintained by a distro we trust because we have to. Supply-chain security isn't a compliance checkbox. It's the difference between a teenager doing their 30-minute daily session on a patched kernel versus an unpatched one. It's whether the digital occlusion shader on the dominant eye actually isolates the lazy eye's signal, or whether a root exploit could flip the eye-selection flag and train the wrong eye. We don't hallucinate metrics. We publish LogMAR scores. We document the shader pipeline. But we can't patch Ubuntu. The HN discussion is worth reading: https://news.ycombinator.com/item?id=50341462 If you're building clinical-adjacent tools on VR, you're already in the chain. Amblyotube is here: https://www.meta.com/en-gb/experiences/amblyotube/25906906972338493/