WTF Ubuntu?

What the fuck, Ubuntu?

搞什么鬼，Ubuntu？

In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel’s TCP code. It’s been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover.

如果你还没听说：CVE-2026-98432 是 Linux 内核 TCP 代码中一个严重（CVSS 评分为 9.8）的漏洞。该漏洞自 2016 年起就存在，因此地球上几乎所有的 Linux 服务器都受其影响，且可以被远程攻击。Anthropic 表示他们已经构建了一个可用的漏洞利用程序，能够获取服务器的 root 权限，实现完全接管。

Debian patched it on October 16. Ubuntu still doesn’t have a patch more than two weeks later. Every supported release, LTS included, is listed as “Vulnerable”.

Debian 在 10 月 16 日就修复了该漏洞。然而两周多过去了，Ubuntu 仍未发布补丁。所有受支持的版本，包括 LTS（长期支持版），都被列为“易受攻击”。

Ubuntu’s website promises “timely patches for critical vulnerabilities.” Ubuntu hasn’t shipped the patch nine days after it was rated 9.8 and six days after a working root exploit. Very fucking timely indeed.

Ubuntu 的网站承诺提供“针对严重漏洞的及时补丁”。在漏洞被评为 9.8 分后的九天，以及出现可用的 root 权限漏洞利用程序后的六天，Ubuntu 依然没有发布补丁。这可真是“及时”得要命。

Software is full of this blabber where words mean nothing. Ubuntu uses words like these: “Timely.” “Enterprise-grade.” “Production grade.” “Enterprise resilience. Developer velocity. Build with confidence on Ubuntu.”

软件行业充斥着这种毫无意义的废话。Ubuntu 使用了诸如“及时”、“企业级”、“生产级”、“企业韧性”、“开发者速度”、“在 Ubuntu 上自信构建”之类的词汇。

Somebody, or perhaps worse, some special team at Canonical is dedicated to writing these…

肯定有人，或者更糟的是，Canonical 的某个特别团队，正致力于撰写这些东西……

So I’m asking again… What the fuck, Ubuntu?

所以我再次发问……搞什么鬼，Ubuntu？

I’m moving all my servers off Ubuntu. I’ve completely lost trust in it. On the desktop I always hated it anyway. On servers I mostly used it because it’s the default on most VPS providers, and I considered it the solid, no-drama LTS distro. Fuck that now.

我正在将我所有的服务器从 Ubuntu 迁移出去。我已经彻底失去了对它的信任。在桌面端我本来就一直讨厌它。在服务器端，我使用它主要是因为它在大多数 VPS 提供商那里是默认选项，而且我曾认为它是一个稳健、省心的 LTS 发行版。现在去他的吧。

I can’t express how crazy this is. I didn’t have time to migrate my services and data when I learned about this, so I had to take all my servers that run Ubuntu offline.

我无法形容这有多疯狂。当我得知此事时，我没有时间迁移我的服务和数据，所以我不得不把我所有运行 Ubuntu 的服务器全部下线。

Oh and btw, distros run by volunteers (Debian, Arch, Alpine…) hve shipped the fix. Meanwhile Ubuntu, made by a company that sells security subscriptions, hasn’t. This is true as of 2026-11-02 14:48 UTC.

顺便提一下，由志愿者运营的发行版（Debian、Arch、Alpine 等）都已经发布了修复程序。而由一家销售安全订阅服务的公司所维护的 Ubuntu 却还没有。截至 2026 年 11 月 2 日 14:48 UTC，情况依然如此。

Added after this blew up: Can’t beat all the bullshit, so I parody it at Bloatberg.

在此事发酵后补充：既然无法战胜这些胡言乱语，我就在 Bloatberg 上恶搞它们。