This is not a problem with Debian LTS, you’re getting timely security updates. Debian fixed this vulnerability three weeks ago within two days: https://www.debian.org/lts/security/

For Ubuntu it was _all_ their kernels though...

LTS distros can track the LTS kernels and they’ve all been updated

Ubuntu is the only Linux distro with an LTS release that has not patched this issue, so saying this is a problem with LTS distro kernels in general is categorically false.

A large number of security issues are not backported to stable or LTS kernels because of resource constraints.

To the extent that you've made specific claims, they are false. It's hard to argue with vague claims about tangentially fixing a security issue but at any rate just looking over LTS releases, they absolutely and frequently do backport security issues to LTS releases. They don't do it for every security issue, but the idea that they rarely do it or only do it as part of a tangential change is once again... categorically false.

Fedora took over two weeks to get a patch out too afaik

Fedora does not have an LTS release, but they patched 1 day before the CVE was published to the general public:

[1] https://bodhi.fedoraproject.org/updates/?search=CVE-2026-984...

Fedora doesn't do LTS releases, but they released the patched kernel two days before the CVE was publicly announced:

43: https://bodhi.fedoraproject.org/updates/FEDORA-2026-bc7bd292...

44: https://bodhi.fedoraproject.org/updates/FEDORA-2026-7b153c4c...

Fedora 45 was only just recently release and Fedora 42 and earlier will never get an official patch since those are no longer maintained.