icy-disrupt-sme

RedHat's web site shows it as a 9.8 at https://access.redhat.com/security/cve/cve-2026-98432. Now, there may be times when Redhat downgrades a score...say for example you have SELinux and the vulnerability is blocked by it but they usually track with the official number.

I suspect they, like Redhat, are including other non-critical updates in the updated kernel and who knows how many kernels they need to build/test since I know they produce custom kernels for cloud providers like AWS and Oracle. I really don't understand why they are all treating a critical update like this as "business as usual"...I saw evidence they kept rescoring the vulnerability to lower and then higher scores. I did see their blog posting saying they are moving from 4 week to a 2 week cadence for kernel updates which is a move in the right direction but AI is coming for our servers...someone needs to send a copy of Spencer Johnson's "Who Moved My Cheese" to Canonical, Redhat, Suse, et al who have made their fortunes back porting code...