Sufficiently "bad" issues are disclosed to multiple Linux vendors at the same time, via the vendor-sec mailing list. If you're a member of a security team for

Sufficiently "bad" issues are disclosed to multiple Linux vendors at the same time, via the vendor-sec mailing list. If you're a member of a security team for a distribution this is generally where you hear about issues. From there coordinated release dates will be agreed, and barring big surprises like one distro pushing out an update too soon everybody _should_ release at the same time. Sometimes people get sick, take a holiday, or drop the ball for other reasons. I'd expect Ubuntu did get notified, but haven't yet tested/built their fixed packages to push out.