Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:

> Why is this CVE high priority?

> See ubuntu cvss score

That's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.

I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.

[0] https://ubuntu.com/security/CVE-2026-98432#priority-reason

I don't think this is fair. They don't do a good job of pointing you at their rationale which is in their security score here[0]. I ultimately had to have claude translate the kernelese in to something my small brain could understand but this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers or degrade data on the system. Especially given that the exploit can only be done if packets with IP options. IP options are commonly dropped or removed from packets on the open web. You not only need a vulnerable system but a vulnerable request path through the internet which you would only know by trying this attack which is very timing dependent with the SYN,Retransmitted SYN and Reset all happening very close together. A motivated attacker could probably do this on your network but over the internet ... It sounds unlikely.

[0]https://ubuntu.com/security/CVE-2026-98432#impact-score

Yeah, their lack of a satisfactory response is the final nail in their coffin. This incident escalates my consulting advice about Ubuntu from “not recommended” to “switch immediately”.

Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not been true for quite a while, they have now jumped the shark into eel-infested waters; I cannot take them seriously any longer.

Plain Debian was always best option; even RHEL dropped the ball on this CVE and that's distro people pay for support

Not always. Notably, if you have compliance requirements like needing FIPS encryption (say because you have government customers), or that requires you to use a commercial vendor, debian won't work. And if you need more up to date system packages, or a reliable release cadence, Ubuntu might be better.

On desktop, if you need proprietary drivers, Ubuntu is easier to set up.

But yes, if debian works for you, I wouldn't use Ubuntu.

I had to deal with FIPS once because the company I worked for shipped a custom Linux distribution with the product and we had to essentially shoe-horn in some Red Hat OpenSSL packages to get it to meet FIPS requirements. What's funny is that the customer enabled FIPS, administration became much harder, and the encryption strength was strictly worse.

Anyway, needing FIPS is something of a niche requirement. Debian or Rocky are very sane choices as a default Linux distribution for general-purpose servers until you run up against special requirements.

FIPS is a US government security standard: https://en.wikipedia.org/wiki/FIPS_140

It doesn't have much to do with this CVE, but if you're trying to sell to the US government, it will often be a requirement, which means that a company making money from those sales will not easily be able to move to a distro without that certification.

>What is FIPS encryption

presumably they mean meeting fips standards https://en.wikipedia.org/wiki/FIPS_140

>why is FIPS unique to RHEL

its not

>what has FIPS got to do with this CVE?

it doesnt. it is brought up in reply to the comment.

Uh, yes it will. OpenSSL in Trixie is a version supported.

https://packages.debian.org/trixie/openssl-provider-fips

It's just the library, nothing special about the OS.

https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4985

As far as I know, compliance comes with an external module:

https://openssl-library.org/post/2025-03-11-fips-140-3/

This module seems to be in Debian:

# apt-cache search fips | grep open openssl-provider-fips - Secure Sockets Layer toolkit - cryptographic utility

# dpkg -L openssl-provider-fips /. /usr /usr/lib /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu/ossl-modules /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so /usr/share /usr/share/doc /usr/share/doc/openssl-provider-fips /usr/share/doc/openssl-provider-fips/changelog.Debian.gz /usr/share/doc/openssl-provider-fips/changelog.gz /usr/share/doc/openssl-provider-fips/copyright

There seems to be the validation process, which supposedly must run on each machine it is used on.

openssl fipsinstall -out /tmp/configfile.cnf -module /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so 2>&1 | tee /tmp/result.txt

--

The above are from my notes, and a test run. But I don't see how Redhat is "special" here. If the module loads and cites compliance, you comply.

> OpenSSL in Trixie is a version supported.

It isn't a validated build. It works the same, but it isn't sufficient if you actually need a validated FIPS module.

> It's just the library, nothing special about the OS.

If you need validation, then the kernel also need to be validated.

Now, it isn't impossible to get a FIPS validated system working with Debian, but you will probably need to contract with another commercial provider like WolfSSL to get validated components. Or compile things yourself. But that is more complicated and involved than just paying for an OS that is validated off the shelf from Ubuntu, Red Hat, or Suse.

The general advice I've been seeing the past ~8 years is "There is no reason to pick Ubuntu over Debian". I don't know who the opposite advice comes from and why anyone would pick ubuntu for a server.

15-20 years ago the joke was that Ubuntu is a Zulu word that, roughly translated, means "I don't know how to configure Debian". Ubuntu was one of the first distros that allowed one to easily download proprietary WLAN drivers without dealing with the terminal, ndiswrapper, or compiling half-broken OSS implementations; for this reason it caught fire with those who wanted to try Linux but were otherwise unwilling to engage in such shenanigans. I tried it on a laptop around this time and was quite impressed. This reputation for "it just works" has carried them ever since even though other distros now do largely the same thing ( cheap, obscure, or recently-released hardware excepted).

I took the lazy Mint route with my most recent machine since I wanted to use it for light gaming with minimal fuss. I'm going to redo it with Nix sometime soon because the value prop simply isn't there and I'd like to try a declaratively-configured distro.

They also sent out free distro CDs. That helped convince me this new fangled Linux thing might be legitimate.

Christ that was 2008.18 years ago. My Linux 'experiment' is old enough to vote

I have received cds with ubuntu 5 or 6, was surprised they actually sent those, but at one point I started using it

[edit] omg circa 2006, firefox was still new back then

The only recent reason I’ve managed to come up with is it far and away has the best support for Nvidia’s various drivers and utilities for running GPUs and its assorted ecosystem, like Infiniband and Spectrum-X Ethernet.

If there’s another option I’m unaware of, I’d love to hear it. Also to be fair, I didn’t evaluate Sid for this, only Stable.

Enterprises love paying for support contracts. If you have one, you can demonstrate something has been accounted for. A secure software without support is worse from an audit perspective than a security disaster with proper paperwork. Most of these people never actually involve support they paid for ever.

> Enterprises love paying for support contracts.

They can pay for Debian support! (I’m not 100% sure who they should go to, but e.g. Freexian are doing Extended LTS for Debian [1], so I suppose they could do a regular support contract as well?)

[1]: https://wiki.debian.org/LTS/Extended

A quick search shows all sorts of projects choosing Ubuntu. Can you explain a project like mail-in-a-box going with it? And 5.15 kernel at that..

I advocated for Ubuntu for years because it was easier to install and had excellent hardware support. For 2026 I have switched back to Debian because Ubuntu has been making my life more difficult. Ubuntu 26 basically forces you onto Wayland even though it breaks some of my use cases, particularly with screen recording. It turns everything into Snaps which is a hassle because it means I need to mirror both the regular repo and the snaps to my closed network instead of just the repo.

Ubuntu still has the superior installer by a good margin, but it does sometimes like to crash when run offline. Debian's installer at least has the option to go text only. There is also more work to do after the install is finished on Debian, but since that's a script it's not such a big deal.

The one bit of the Debian installer I dislike the most is how if you aren't online when you do the install you get a completely empty sources.list, and the Debian sources are a lot more complicated than Ubuntu's. Debian's support for third party drivers like nVidia graphics is also more complicated and confusing than Ubuntu's.

Platform support. Oracle Cloud for example only provides images[1] for Oracle Linux, RHEL, Ubuntu, and Windows Server. Anything else you have to bring your own.

[1] https://docs.oracle.com/en-us/iaas/Content/Compute/References/images.htm

If I try to create a new instance on Oracle Cloud, these are the options: Oracle Linux, Ubuntu, RHEL, (CentOS), Windows Server, AlmaLinux, Rocky Linux.

Anyway you are right, I would have switched already if Debian was available. I guess AlmaLinux could be an option to consider, since I've read in another comment that they've patched ahead of upstream for several vulnerabilities this year.

For x86_64, It's relatively easy-ish to upload your own Debian image, from Debian's generic cloud QCOW2 image, and it works just fine. I think ARM needs a bit more work if I remember correctly.

(But 100% agree this shouldn't be necessary).

What's your recommendation nowadays?

Debian

As far as I know the only working exploit is working on machine with MultiTCP enabled. Redhat also downgraded the issue to "high" and also did not release a patch yet. I would have preferred a patch but I accept that they know better than me what they are doing.

The more I look at this the angrier I get. This is a CVE that Anthropic claims can get a Remote Code Execution on vulnerable systems, which includes default Ubuntu installs running any sort of Go server like Caddy. Bad enough that I shut down my personal website and self-hosted tools (sorry for any typos, my grammar checker is also down).

And this is how Ubuntu describes the vulnerability to sysadmins:

  In the Linux kernel, the following vulnerability has been resolved:
  ipv4: free inet_opt and ireq_opt after an RCU grace period
  tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
  child socket (newinet->inet_opt) without copying it.
  Another cpu can concurrently process a retransmitted SYN for the same
  request socket, and send a SYNACK from tcp_check_req().
  tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
  under rcu_read_lock() only, and ip_build_and_send_pkt() and
  ip_options_build() then read opt->optlen twice.
  Note that the SYNACK timer itself is not an issue: it holds a
  reference on its request socket, and inet_csk_reqsk_queue_drop()
  calls timer_delete_sync() before the child can be freed.
  Since commit 079096f103fa (“tcp/dccp: install syn_recv requests
  into ehash table”), request sockets are processed without holding
  the listener lock, so nothing prevents the child socket from being
  freed while the SYNACK is still being built. TCP child sockets do
  not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
  with a plain kfree(), leading to a use-after-free in
  ip_options_build().
  A similar issue exists with request socket migration
  (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
  program). reqsk_timer_handler() clones the request socket with
  inet_reqsk_clone(), so that the old request socket and its clone
  share the same ireq_opt, then reqsk_migrate_reset() clears the
  pointer in the old one. Another cpu holding a reference on the old
  request socket can still be using these options (sending a SYNACK,
  or creating a child in tcp_v4_syn_recv_sock()) when the clone is
  freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().
  Readers already use RCU, and other paths replacing inet_opt
  (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
  kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
  tcp_v4_reqsk_destructor() as well.
  IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
  duplicates the options. tcp_v6_reqsk_destructor() has the same
  migration issue with ipv6_opt, which is only set by CALIPSO. This
  will be addressed in a separate patch.

How is this in any way, shape, or form acceptable two weeks after the CVE was published?

> running any sort of Go server like Caddy

It's so much worse than this, and there is a staggering amount of misinformation running rampant about this bug.

MPTCP is not a requirement, it can be exploited merely by sending specially crafted TCP packets with (any) IP options set. No special MPTCP support, web servers or any specific software listeners are even necessary at all to trigger it, just send the packets and boom.

I think the reason people assume MPTCP is a requirement is because that's what the PoC used... but MPTCP itself also doesn't even rely solely on IP options.

Ubuntu also does not even list a single mitigation strategy... at least RHEL did.

And like I said, any normal TCP packet that contains IP (not TCP) options can trigger the bug. I cannot emphasize enough how important and absolutely ridiculous this is.

Like the post says, this is big enough to get a massive amount of people to completely stop trusting Ubuntu entirely and jump ship.

sorry for any typos, my grammar checker is also down

I assume this is unrelated to the Ubuntu situation, but how does a grammar checker go down? We've been doing offline grammar checking since computers had 64K of RAM.

Self-hosted LanguageTool server[0] with browser addon. 18 gigabytes of n-gram data plus machine learning models. You can catch tpyos on 64K of RAM, but not any deep grammar mistakes, un-idiomatic phrases, or mistakes in common proper names.

[0] https://dev.languagetool.org/http-server.html

consider harper instead. I'm using it right now and it highlighted first two words of this comment. https://writewithharper.com/

Moved to Debian few years back and never looked back. We used Ubuntu for a bunch of clients and unfortunately had to let them know they will have to migrate to Debian or similar. It's such a shame because I really used to love Ubuntu until Canonical started turning slowly into your typical everyday corporate.

I believe RHEL/Alma/Rocky has released patches today. I have a notice about they have done so.

Alma released a patch ahead of upstream again, just like they did for several other critical vulnerabilities this year.

Is RHEL really unpatched still? Looks like patches came yesterday: https://access.redhat.com/security/cve/cve-2026-98432

Thanks, I removed that part from my comment. Still, that's two weeks late.

>Still, that's two weeks late.

Agreed! I know this is a bad month, but this is poor form from several vendors that tout "we'll handle XYZ aspect of security for you".

For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:

* https://launchpad.net/ubuntu/+source/linux

You can pull them down with a "-t" added to your apt-get (but will not appear by default).

26LTS had the new kernel go to the updates/security repos on October 28.

> You can pull them down with a "-t" added to your apt-get (but will not appear by default).

How does that look like exactly?

It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.

The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.

Just a title designed to generate the maximum outrage followed by a few meaningless lines.

I read the whole post and still don’t have any idea what it is and how severe it is. Ubuntu has not marked it critical. Is there any reason to disagree with that assessment? In an entire post criticizing Ubuntu you’d think they would at least make that case.

They have also not shared why they didn’t patch their kernel directly when updated versions have been available for a couple weeks now. Why wait for Ubuntu at all?

> I read the whole post and still don’t have any idea what it is and how severe it is.

From the article the bits you need to know:

1. CVE-2026-98432 is a critical (CVSS 9.8) bug.

2. Anthropic says it built a working exploit that gets root on a server.

You are talking about the company side of the issues. We are talking about the specific issue that is concerning our ubuntu servers. What is the security bug, and how can someone exploit it? Where is that written?

But Ubuntu is not some small distro maintained by unpaid volunteers; they are a corporation that offers paid support. I think it reasonable to be disconcerted when a company that you are paying for security updates is this negligent, especially when other distros have fixed this issue far more expediently.

This is a major failure on Ubuntus part. The constructive feedback they deserve is literally the title of the article.

The post gives enough detail, there is a vulnerability that allows root access on servers on the TCP stack, so literally accessible if you are running any service. There are exploits in the wild. Debian has the patched kernel, Ubuntu does not 2 weeks after the CVE is known.

> how critical it is,

9.8 out of 10 btw.

> how it is impacting them personally,

They are clearly rather upset by the lack of an appropriate response.

> how vulnerable their servers are,

They are literally open to anyone with an AI subscription.

> how they are working around it.

They are migrating off Ubuntu.

If Ubuntu offers LTS and is catering to business it is very much open to criticism. They can take it or leave it, but anyone is entitled to an opinion about it.

The post is making 0 demands, they're made a valid statement and moving off Ubuntu.

>The post gives no details about what this vulnerability is, how critical it is

what? the literal first paragraph says:

"In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely"

But Ubuntu is not the embodiment of "open source". It's a business. With managers...

I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone to care" phase which we all know so well...

If someone does a v2 let's hope they make sure it's actually exploitable when they set it up so they don't leave hundreds of people with the assumption that the cve is not a big deal when the CTF was just misconfigured and the system got pwned in less than 2 hrs after they fixed it

CVSS in general is not the best proxy for "real world impact". You could have a 10 on a software thats only deployed once and the impact would be tiny. In this case, multipath is not used that much (except by go).

Go is everywhere in server environment. It's absurd to claim that multipath is not used that much. Maybe it's me, but go literally everywhere around me.

Also this vulnerability is not strictly about mptcp, although the exploitability is not clear.

But they have very valid point: a CVE 10.0 with root RCE on twenty internal servers is lower risk than one vulnerable internet-facing server. All need to be patched, but the one on the Internet is your critical risk, the others are medium at worse.

It's trivially easy to disable multipath in Go.

I think it's less of a concern over the internet because the kind of packet necessary for the exploit tends to be filtered out, but it's pretty scary as an escalation mechanism from e.g. an end-user device to a core server.

Much like with PHP2Shell, it doesn't need to be utterly trivially exploitable to be a big concern.

Here is Ubuntu’s webpage on this vulnerability:

https://ubuntu.com/security/CVE-2026-98432

It’s still, over a week after disclosure and patches, unpatched in Ubuntu.

As for me, a part of me wants to move over to Rocky Linux 10.

I don't quite understand this page. I thought the kernel binary was in the `linux-image-*` packages in Ubuntu.

For example, I have linux-image-generic installed, description "Generic Linux kernel image This package will always depend on the latest generic kernel image available." and then "Depends: linux-image-6.8.0-147-generic, linux-modules-extra-6.8.0-147-generic, linux-firmware, intel-microcode, amd64-microcode"

Why isn't there linux-image or linux-modules- listed as an affected package?

First I thought it was the source package / binary package distinction, but e.g. linux-image-7.0.0-38-generic says "Source: linux-signed-hwe-7.0", and linux-signed-hwe-7.0 isn't listed as an affected package either.

So what's going on here?

Yeah that literally is in "does not compute" territory for me. That page literally opens with "Ubuntu priority High [..] 9.8 · Critical [..] Publication date 15 October 2026 [..] Last updated 30 October 2026" which is exactly why "WTF Ubuntu" is the right response here.

> Rocky Linux 10

Does Rocky use their own community-built packages, or does it use RHEL's?

Because I don't think Red Hat have released patches yet either?

It’s fixed in RedHat:

https://access.redhat.com/security/cve/cve-2026-98432

For RedHat/Rocky 10:

https://access.redhat.com/errata/RHSA-2026:93413

Also, a mitigation:

https://access.redhat.com/security/vulnerabilities/RHSB-2026-016

It isn’t quite in RockyLinux yet, but Rocky has a special security repo for getting updates quicker than the RHEL → Rocky security update path:

  sudo dnf --enablerepo=security update

(This command is run every time one needs an urgent security fix right now when using Rocky Linux)

Reboot to have the new kernel

This is how to get the patched kernel right now if running Rocky Linux.

Here is the patched kernel (`rpm -qa | grep kernel-6`)

  kernel-6.12.0-211.69.1.el10_2.x86_64

More information:

https://rockylinux.org/news/2026-05-14-introducing-security-repository

https://forums.rockylinux.org/t/cve-2026-98432-any-roadmap/20903/3

14.04 LTS trusty is not vulnerable fyi.

Canonical still maintains it. If you're just hosting some HTML or even PHP, you have a comfortable amount of time before you need to upgrade, assuming you're a paying customer.

I jest, but we had (HAD) an Ubuntu 18.04 LTS that received the backported patch for PHP2Shell, even if the version wasn't supported officially by PHP.

This is why I insist our developers use the Ubuntu repositories instead the official PHP ones: besides possible instability, PHP doesn't do ancient backports.

" Anthropic says it built a working exploit that gets root on a server. A total takeover."

From the linked Ubuntu CVE page

" Vulnerable system - Confidentiality impact Low

Vulnerable system - Integrity impact Low

Vulnerable system - Availability impact High

" suggesting it's more of a denial of service. So which is it, there are dozens of kernel CVEs fixed in the linked debian email.

This is the straw that broke the camel's back. I am moving back to Debian stable now. Having NVIDIA drivers and Wlan drivers back in 2014 was great, but this is not acceptable.

It's not just Ubuntu is it? I think Redhat still hasn't released any patches? (their status still says 'ongoing')

I think they shipped patches yesterday. Which is still a long wait.

https://access.redhat.com/security/cve/cve-2026-98432

When AWS is shipping patches for Amazon Linux 2 and Ubuntu is still waiting.. yeah.

I get the frustration, but isn't there an iptables rule that is a viable mitigation? Why not deploy that first?

Why do you ask such simple and obvious questions!? :-P

nft add table ip cve_2026_98432

nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'

nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop

Because you shouldn't have to do mitigations for this level of severity while waiting weeks for OS patch. I did that, but now I'm waiting for patch to unwind my mitigations.

Talking of which, is there a link to the temporary fix?

`iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP`

(Taken from https://aws.amazon.com/security/security-bulletins/2026-160-aws/)

You can also use the following Suricata rule if your network firewall supports it:

`drop ip any any -> any any (msg:"CVE-2026-98432: drop IPv4 packets carrying IP options (IHL > 5)"; ipv4.hdr; bsize:>20; classtype:bad-unknown; sid:1000001; rev:2;)`

What is keeping people on Ubuntu instead of just using Debian? I'm genuinely curious. What is Ubuntu offering that Debian doesn't provide?

I think it's just brand, ubuntu was what I knew from using it as a personal desktop and then it's the default/most obvious option for a lot of providers, I think even 10+ years ago AWS EC2 defaulted to it above Debian, digital ocean too I think?

I don't remember why exactly but it was definitely just 'linux VPS = Ubuntu' for a long time. I think they got reputation as being the 'just works' option because they were happier to include some non-free graphics drivers etc where Debian was the more pure option but most end users didn't care

But since they added snap and I started running into issues with trying to install Docker etc a few years ago I default to Debian now and most of the time I don't even know which it is.

> Stable Debian is using Linux 6.12, if your laptop has modern hardware what do you do? Can't use wifi?

And Ubuntu 24.04 LTS is using 6.8.

Ubuntu releases a new version every six months, but an LTS — which is probably what most people run in production — only every two years. Debian releases come out every two years.

So if you only run Ubuntu LTS, the release cadence is the same as Debian.

I think you're forgetting about Ubuntu 26.04 (LTS) that is using kernel 7.0.

> I think you're forgetting about Ubuntu 26.04 (LTS) that is using kernel 7.0.

Which only came out a few months ago, and which only recently released its .1, so the do-release-upgrade message only recently appeared for most people.

I'd be interested to know how many folks have changed their current production over to 26TLS in the last six months. I'm guessing not a lot.

So yes, there is a newer LTS, but what is its current market share as compared to 24 TLS (or even 22LTS)?

Ubuntu releases its LTSes in even years, and Debian does its releases in odd years:

* https://en.wikipedia.org/wiki/Debian_release_version_history#Release_table

You can use backports if you want a newer kernel, e.g. trixie-backports has 7.2.11.

That, or just pick the kernel package from unstable or testing. Apt is smart enough that mixing packages from different versions of Debian works just fine.

(I mean nothing is 100% but I've been mixing packages for like 2 decades now and literally can't remember any specific trouble resulting from it.)

> That, or just pick the kernel package from unstable or testing. Apt is smart enough that mixing packages from different versions of Debian works just fine.

While I won't deny that this may often work, I disagree that it's a good idea, and that `apt` being smart is sufficient to guarantee that this works (or keeps working in the future).

Pinning specific packages from `testing` or `unstable` is explicitly discouraged, for very good reasons covered by this classic link: https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_FrankenDebian .

Arguably, the backports kernel is the right choice to get a newer kernel on Debian Stable. Indeed, in the past, the backports kernel could take awhile to update, but no more - case in point, `trixie-backports` currently contains `7.2`, same as `unstable`.

It's not apt not being smart that can cause troubles when mixing packages from various suites. There's no reason to mix in cases where you can just use backports instead.

> I want a LTS distro not a testing one.

You either want to have the new stuff or LTS. You can't have both.

Debian security team used to offer support for testing, but as the distro grew and attack surface increased, that was dropped. However, security incidents are patched in unstable as well and they float up to testing relatively quickly (for a desktop system, anyway). When things freeze, security updates directly land on testing as a fixup polish.

However, while Testing is "relatively secure", it's never "Server secure". I'd never use testing or testing packages in stable or any server for that matter.

The comment you're replying to makes clear that they're not using it on servers. I do the same thing (testing on my laptop(s), stable on my servers); you just have to commit to keeping track of what's going on and manually patch if you think that it's necessary.

I have to add that for me, testing definitely breaks stuff sometimes. Nothing beyond my ability to fix, though. Nothing beyond anyone's ability now that AI is around.

> I have to add that for me, testing definitely breaks stuff sometimes.

That's interesting, can you give an example? Asking as a curious Debian user.

This and other issues in parent comments is exactly the reason why I switched to Fedora.

You opt into backports and run the shipping 7.2 kernel: https://packages.debian.org/search?keywords=linux&searchon=names§ion=all&suite=trixie-backports

It's not 'as supported', sure, but I'll also note that wifi, at least, has worked on pretty much every modern laptop which I have installed Debian upon.

> Stable Debian is using Linux 6.12, if your laptop has modern hardware what do you do? Can't use wifi?

Why not just install a newer Linux version from the official backports repository if you need it?

https://backports.debian.org/

Well you may want to know that Ubuntu LTS releases are based on Debian unstable, not even testing...

> Stable Debian is using Linux 6.12

But nobody runs Debian stable on their laptop.

They run Debian unstable or testing, with firmware.

And everything just works

Back in 2005-2008 or so, I think Ubuntu was a genuine breakthrough as a polished desktop version of Linux that set a standard that various other distros, eventually, caught up to. I think Cinnamon and other distros eventually caught up on polish.

They also had credible commitments to long term support that brought people on board. I think that was enough to get them on the map, but personally as a desktop user, I haven't used it in a while, mostly sticking to Debian and Arch.

Yeah this was the same for me. When I first made the switch to Linux for my dev machine Ubuntu was the distro I was by far the most familiar with so that was just the default choice. Later on after learning more and seeing how Ubuntu progressed I regretted not going straight to Debian.

I think you are right about the branding / reputation. Personally I heard negative things about Canonical and I heard that they just basically follow Debian, so why not use the original? It's been a great experience so far. Perhaps because Debian moved to include proprietary drivers out of the box now it is extremely easy to set up.

Using linux for over 25 years now. Tried ubuntu once. Immediately dropped it when I saw an ad in the motd. Not a serious distro in my eyes

I just wanted a human recommendation; don't trust the LLMs at all.

Thanks for the link (above).

>can't set up port forwarding

After October 2026, nobody should be port-forwarding IMHO.

I am next to learn about the "tailscale options" of this new world.

Wish us all luck.

In the US, my experience is that it's more difficult than ever to get an appointment with a doctor.

Here in NL as well. I attribute it to population ageing (babyboom generation), but AFAIK that issue is much less severe in USA than other countries which suffered in WWII. China is going to have the issue severe due to the one child policy. That population is going to get reduced a lot (not taking into account migration).

In my EU country, making an appointment got extra steps asking about one's mental state, namely depression or loneliness. One wonders if this age of social atomization, people (probably mostly those elderly) are making unnecessary appointments just to have someone to talk to.

That may be part of it but my guess is that since patients tend not to proactively mention depression and loneliness to their doctor, the doctor's office wants to know in advance whether they should be referring you to a mental health specialist.

Local minecraft server definitely requires port forwarding at the router... as I've learned to my chagrin that Starlink doesn't support port forwarding... Goodbye self hosted minecraft. Did it for nearly a decade and cannot anymore.

Honestly didn't even know if it was something [genericized, or specific?] like "fedora" or "ZFS" (where there are multiple wrappers of it) so thanks for all the help from everyone.

Now I have learnt something.

Try here...

https://distrowatch.org/index.php?distribution=debian&release=all&month=all&year=all

seriously: I am a bluecollar electrician that has absolutely no clue what I am doing. I have several machines because I constantly >BRICK< OSes...

As I only really learn visually (i.e. I love GUI environments), LLMs have enabled me to (quite dangerously, I might re-enforce) finally explore Linux (from MacOS for ~40 years).

I have tried for a long time (to adopt any Linux) – the fact that an LLM also won't be a sassyb when asking simple questions... is one reason I am so comfortable with my/our future(s).

> What is Ubuntu offering that Debian doesn't provide?

Surprised how many answers here are on "social" reasons, and ignoring that Ubuntu does provide genuine additions to Debian.

Ubuntu includes additional proprietary drivers to Debian. So there are legitimate hardware cases were Ubuntu will work out the box and Debian won't. I can't speak for how many people need those drivers, and how much of choice is down to defaults/inertia etc.

From hearing interviews with PopOS folk, I think this is also a big reason people choose Ubuntu as a base for a lot of Distros instead of Debian.

Using Ubuntu as a base became popular partly for the hardware support, codecs, ease of installation. Typing this from Linux Mint, which offers both the default Ubuntu based edition, and LMDE (the Debian Edition).

Debian has caught up, but it's been a minute since I've installed it.

How many of these additional proprietary drivers are needed on cloud servers, which are based on popular hardware configurations?

What are the numbers of people still installing servers on the real hardware and needing these proprietary drivers?

to capture the cloud market, you also have to capture the mindshare at the desktop market. Do you think a new Linux distro comes out and people just install it on their servers? They try it out on the desktop first to see if they like it. It's why Fedora exists to get people into RHEL.

Precisely, I really don't follow this discussion. Cutting edge drivers is what I want on my gaming PC.

Is AI changing the game where more people want bare metal and GPUs with proprietor drivers?

A fair few years ago I did run Ubuntu on my desktop and laptop when I wanted some more similarity with my servers which ran Debian.

And similar breakdowns with Fedora/RHEL.

But Ubuntu or Fedora on a server? No thanks.

> Is AI changing the game where more people want bare metal and GPUs with proprietor drivers?

Yes, for GPU workloads or just raw container orchestration platforms. Or gaming!

> Fedora on a server? No thanks.

Fedora's pokemon evolution turns it into RHEL, with not much change.

> Precisely, I really don't follow this discussion. Cutting edge drivers is what I want on my gaming PC.

I get the sense that the OP of this particular thread was asking about Ubuntu in general, not just the server. If it was the server, I'd understand it, but Ubuntu on the desktop still makes sense. And yes, Ubuntu is in my gaming laptop.

> How many of these additional proprietary drivers are needed on cloud servers, which are based on popular hardware configurations?

A lot of those are running on bespoke hardware specific to the hyperscaler.

Back in the day in 2008, Linux was niché.

It had issues all the time, and finding solutions required searching online, manually. Time consuming, difficult process. Very un-beginner-friendly.

From the throve of all possible distros, one stood out. Ubuntu. Very popular. Askubuntu Forums (with coffee beans denoting ranks) was the place when, 9/10 times, the answer to your problem could be found.

So when your fedora friend cried trying to get his camera and sound working, you either found the solutions already, or asked for them and got them. Usually the former.

That was the biggest advantage of Ubuntu. Big community and wealth of troubleshooting knowledge already available. And it had the opinion of a beginner friendly system. Which made the community grow and created a large market/userbase for help threads/tutorials.

Add to that, that people are creatures of habit and 'voila - you have a lot of people sticking to Ubuntu just because they never got so pissed at them that they would change their distro.

Is Debian still considered beginner un-friendly or had it improved in that respect?

I think it's improved, but I installed Debian on a laptop recently and the fresh system came up without wifi, which was bewildering because it connected to wifi during the install process. Took me a bunch of troubleshooting to find a rfkill setting buried in the system.

AI: you probably turned on airplane mode

me: I definitely didn't

So I love debian but it's still rough around the edges and I'm not sure I'd recommend non-technical people dive in.

This has been my exact Debian experience since I tried it on Debian 3.1. On every system at least one of network, sound, display, or power management just wouldn't work out of the box even if they did in the installer.

I ended up on Mint because I consistently found that Debian was willing to compromise their philosophy for the live distro installer, but they would never warn you that you were about to reboot into an air gapped system.

It's much better these days.

The old installer (boot-floppies) was legendarily prickly at the time Ubuntu was introduced, but it's long since been replaced by the much friendlier debian-installer. And the default install images now include non-free firmware by default, so modern wifi, bluetooth, and graphics hardware are fully supported.

To be honest, Debian now tends to be fairly vanilla and boring and it's actually Ubuntu that often ends up being a bit weirder. For example, consider how they treat the Snap packaging system for consumer software, or the rust rewrite of coreutils. Debian provides both as supported options (of course it does, Debian supports pretty much everything!), but Ubuntu pushes them to all users by default.

The traditional answer is that Debian is a bit slower-moving in both the Linux kernel and userland, so people who want current versions of popular software often find that they have to do some extra work in Debian.

A gradually increasing number of popular userland applications have been publishing their own apt repositories however so this is less of a problem now than it used to be.

Over the years though I've found that I much prefer Debian's relative stability and more thoughtful, if slightly plodding, release cadence.

Ubuntu just copies Debian's packages. The release cadence is the same: 2 years. It really is just intertia at this point.

Ubuntu issues a version release every 6 months, and there are updated packages in the interim.

I'm on Kubuntu (home installs) but have been looking to move since Ubuntu went over to Snaps and started breaking everything (MX looks most likely for me). The task of moving the family over is stopping me; I've been using Kubuntu for a very long time now.

You can just use Debian Testing/Unstable. It's good enough that's where Ubuntu sources their packages anyway.

Debian is currently on 3.14.8.

Ubuntu is a Debian distribution that releases more often. A faster update cycle for their packages is basically their entire reason for existing.

I may be biased as a Debian user, but if Ubuntu now reacts slower than Debian this may push some people to reconsider their choice.

For me it's just because I've been using Ubuntu full time since 2008 and has served me well my entire career, I think it's fair to say it's the flagship desktop OS that introduced many to Linux.

I feel like we're close to a post-distro era of operating systems though. My ansible playbook customizes so much already it wouldn't take too much more to just start from debian tbh.

Me same. I'm on ubuntu since 16.04 and it's annoying switching, because I'm used to it so much. Definitely switching on Debian, because they're not shipping software through apt anymore (eg. browsers). I'm running that through nix right now, and I don't want to deal with this nonsense.

I was thinking of just going entirely to Nix. The last time I tried it was 2021 (on a dual boot where I also tried Arch cause my colleague was bemoaning my Ubuntu usage). Yeah, it is annoying having to look up how to configure things the Nix way, but it all makes sense and it stems from the fact every application does it 'their way'.

Either way, I just wanted to note you can use APT to include Mozilla's Firefox and Thunderbird repo. That way, you get a .deb from them.

One specific thing I like about Ubuntu: I know a new version gets released every six months (I believe OpenBSD innovated this?) and the version is recognized by date. The LTS is released every two years around april in the even years. Otherwise it is april/october.

> it's annoying switching, because I'm used to it so much

Since you're switching to Debian, could you tell me what you don't understand in Debian that was working fine on Ubuntu for you?

I am not an Ubuntu user, so it's hard for me to know. But I find it very surprising that after 10 years on Ubuntu, it would be "annoying" to switch to Debian.

Install Ubuntu and you get 10-15 years of support of your current software stack.

Install Debian and you get 3-5 years of support.

Ubuntu also invests a lot into their desktop experience while Debian is closer to stock Gnome. That's more of a preference thing, though.

Debian has also traditionally been a pain to use with proprietary software. Nvidia drivers, WiFi firmware, you name it. It got better in the past years but it's hard to shake the bad name.

Or, maybe, good name? They fight the good fight, even if they're not winning.

For me, it's not so much "what does Ubuntu have that Debian doesn't" and more that "just use Ubuntu" has only bitten me twice.

It's 2009 or so and I want to try Linux. "Just try Ubuntu" they say, and I have a good time. I see that many "How to use X on Linux" guides, or FOSS software, often build for only Debian, and sometimes only Ubuntu. This is fine until snaps give me huge problems in 2018, and so I completely stop using Ubuntu desktop.

Now in 2026, I manage three servers (two on Ubuntu), one Raspberry Pi (on Ubuntu), and two Linux desktop installations. I stopped using Ubuntu desktop in 2018 but snaps are less problematic for my server workflows, so now I have three Ubuntu server installs. On my desktops and my one non-Ubuntu server, I find myself sometimes missing Ubuntuland. (These aren't Debian though, so I might just be missing Debianland.)

"Just use Ubuntu" is now something that has bitten me in using servers. Two bites in 17 years is a fantastic track record. But this slow response to a CVE fix has me looking at Debian, and this has shaken my faith in canonical. "Do they pull in upstream security fixes quickly" is one of my first questions for any FOSS I use.

But my servers aren't Nix or IaC or whatever, and so... Taking them down and putting them up would take a lot of time and risk, which are two things I'm not so willing to spend. Maybe it's 10 minutes, or maybe there's a bandaid fix I have from 2023 that I forgot about and would need an hour to re-derive. So, I find myself taking the security gamble instead.

Ubuntu offers a path from free use to paid first party support. For me, that makes it very attractive for a startup or small business that may want to add a support contract later. Ubuntu makes it a lot easier than Red Hat. Paid support for Debian is via third parties. Ubuntu is a solid distro, although I think Debian is a better one if paid support isn't an important feature to have.

I only run Debian personally, but my dayjob company runs on SQL Server, and the officially supported options there are Windows Server, Ubuntu, or RHEL. It's not worth the effort dealing with management/auditors/etc. to try to run our prod DB on a non-supported platform.

Ubuntu has a timeline for how long they will provide updates for a given long term distribution release. I moved over to Ubuntu back when CentOS was converted in to a Fedora type release without a long term commitment to providing security fixes.

I might be moving over to Rocky Linux 10.

This is the big reason that I see a lot of companies using it over Debian.

Five years of guaranteed updates, with an option to pay for another five years ticks the box for accreditors and the like.

The much vaguer Debian policy that a release will be supported for some undetermined period based on how frequently they release, and then get some kind of volunteer-based LTS support for a couple of years after that, and then maybe further through some third-party ELTS program is a much harder sell.

We migrated to Ubuntu from CentOS as well. It was simply because Rocky wasn’t established enough at the time and we haven’t had a reason yet to again look elsewhere. Tho we haven’t also phased out most VMs for containers of some sort.

For some reason I had feeling that Ubuntu more "serious" than Debian. I mean they're asking for money from people. So it's basically Debian with paid services. Can't be worse than Debian and probably is better, maybe they paid some engineer with these money to patch things faster.

That's just some rough reasoning in my head.

Also when you install third-party software, 100% of them will support Ubuntu. That's more about workstation usage, though. But having tested platform matters.