Hi all, representing Canonical's product team here. We have fixes available for Ubuntu 22.04 LTS and newer in the -proposed pocket which are being tested for stability. These can be applied by users and we published a blog with the details. We sincerely appreciate the feedback and will follow up as soon as we can with more information https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f....
This really needs to be hot fixed and just fast tracked to release. It’s for sure costing Canonical’s image and makes it difficult to continue to consider Ubuntu for serious server deployments going forward.
The fix is available in the -proposed pocket for users who perform their own kernel acceptance tests. Under our unified two-week kernel SRU cycle, in the first week we build and smoke-test kernels and publish them to -proposed. In the second week we run certification and regression tests on Ubuntu Certified hardware. Once that testing completes, the kernels are released to the -updates and -security pockets. We keep this step to avoid regressions, and we think it’s the right balance between speed and reliability.
IMO Three weeks is not a right balance of anything. I don't blame you personally, but taking this long is completely unacceptable. These issues are going to keep happening even more frequently as time goes on, so something needs to change. Your customers are going to start blaming you (even legally) for their systems getting hacked due to your company's negligence.
I will not be using Ubuntu for any future desktops, laptops, servers, containers or anything else.
Why are the relevant packages not available in the main or even security repos?
Three weeks is plenty of time.