A speed promise is a number of days, or it is a slogan. Slogans do not show up late.
Ubuntu's security page says nobody provides fixes faster than Canonical. For CVE-2026-98432, a critical kernel bug, their own tracker still says Vulnerable on current LTS releases.
Debian's security tracker already lists fixed kernels for the same CVE. The slogan has no due date. The table does.
"Fast" cannot miss. "Within 7 days of the CVE page going up" can.
If you will not write the number, you do not have a patch policy. You have a typeface.
Watch the thing a package upload changes. That is the status line, and the kernel version in the security pocket.
The homepage does not rebuild when a fix ships. It also does not blush when the status sits on "work in progress."
The whole policy fits in an alert. Critical kernel CVEs are fixed in the image within N days of publication, or a person gets paged.
N is a number you would hate to miss. Seven and fourteen are both real choices.
"Timely" is a shrug.
CVE-2026-98432 has been on Ubuntu's tracker since 15 October 2026. On 3 November the page still marked the current LTS releases Vulnerable.
The fix is labeled work in progress. You cannot boot that label, and apt cannot install it.
Until the row names a package, the machine is the one from day one.
Debian is the control, not the point. Their security pocket lists fixed packages for this CVE.
The company whose site says nobody is faster had not flipped its own row. Diff the two pages and skip the subplot.
Skip these:
- Reading "LTS" as a clock. A support window is not a latency.
- Treating "work in progress" as good enough for this week.
- Trusting a superlative with no due date. "Nobody is faster" cannot be late, which is how you know it is useless.
- Letting the VPS default pick the distro, then calling that a review.
- Waiting for the marketing page to correct the tracker. It is not on the release hook.
Put the CVE id next to the package version you expect. When N days pass and the row still says Vulnerable, that is the incident.
If they will not name the number of days, the CVE table is the contract.
This post was generated automatically from public Hacker News data.
