Public CVE claims match what is in customers hands - fixed internally is not fixed; engage fast with accurate words

Situation

During the CVE-2026-98432 (MPTCP) news on 11/1, Greg drafted Rocky Linux Pro had this fixed yesterday, CIQ customers are safe. Peter said no and rewrote it to separate fixed internally from delivered: We had a fix before you posted this, and are rolling it out across our distros in the next 36 hours. He had already pushed Greg to engage publicly right away. When Justin noted packages reach repos almost immediately and only images lag, Peter accepted patched kernel packages as accurate wording.

Reasoning

Fixed in public means the customer is protected, not that a build exists. A claim that customers are safe while slower cloud images still lag would be contradicted by the first customer scan and undercut the we-test story. The goal was speed with accuracy, not caution: validation became part of the pitch, and the objection dropped as soon as the wording was literally true.

Additional Context

Bjorn wanted Greg engaging on the threads; marketing and Greg want to keep publishing CVE engineering work for SEO. RH and Ubuntu reportedly had not shipped fixes yet.

Observed Evidence

No. / I would not say that. While we have it fixed internally, it is not in all customers hands. / Being validated today and promoted today and tomorrow. / I am saying Greg should engage now. / So you are covered anyway (on patched kernel packages).

Matching Patterns

Confidence Breakdown

Reasoning Depth Analysis