I suspect they, like Redhat, are including other non-critical updates in the updated kernel and who knows how many kernels they need to build/test since I know they produce custom kernels for cloud providers like AWS and Oracle. I really don't understand why they are all treating a critical update like this as "business as usual"...I saw evidence they kept rescoring the vulnerability to lower and then higher scores. I did see their blog posting saying they are moving from 4 week to a 2 week cadence for kernel updates which is a move in the right direction but AI is coming for our servers...someone needs to send a copy of Spencer Johnson's "Who Moved My Cheese" to Canonical, Redhat, Suse, et al who have made their fortunes back porting code...