The thing I haven't seen anyone point out is that the diff for the fix is literally just +8 chars. Any of the kernel engineers Canonical has on their payroll can review it to ensure that it logically does not introduce new failure modes (as can their agents), and it is trivial to backport all the way to the 4.4 kernel. Does Ubuntu really not have an urgent CVE release workflow figured out yet? Surely this isn't the first time something in the base system needed a patch?

I also want to point out that the very complicated instructions Canonical has supplied in the linked post will likely break zfs-dkms, "native" upstream support for which is the only reason a lot of people are using Ubuntu instead of Debian; the instructions would have you enable -proposed just for main, but zfs lives in universe and the version of zfs you have installed will probably not work with the prerelease kernel in -proposed.

This is the best they can do? I have to run a load of commands that switch source trees for a core part of the OS, and then presumably maintain that and at some point switch back going forward?

Why can’t they just handle this in the standard way that everyone else has done that we can apply our existing processes to, rather than having to work out a way to support this across infra?