As many of us use LTS versions in production environments, I really find it appalling that you are first fixing the CVEs for the latest version, while LTS version is not even touched from that perspective... Our security advisory is screaming about the things like this, and we're near to decision to switch to other distribution.
An example: https://ubuntu.com/security/CVE-2025-38561
Debian already got it fixed: https://security-tracker.debian.org/tracker/CVE-2025-38561
From a general perspective, a bug might be fixed in the latest release first, because the upstream authors fix the bug in the latest version of the software, and then Canonical has to backport the bug fixes to older versions that are in the LTS releases.
From the specific perspective of this bug, you appear to actually be wrong, and this is not LTS related.
First, this is a kernel bug, and the linux kernel is distributed differently in Ubuntu than other software. For the kernel, you can choose from a wide range of kernels, including the HWE kernel which is currently the same kernel in the LTS version as it is in the latest version of linux. So if after running updates and rebooting to a new kernel, if your system is still being detected as vulnerable, your system may not be configured to pick up the latest kernel.
Second, looking at this specific CVE, it only affects a very narrow range of kernels, and the bug isn't even present in the vast majority of them including older kernels. If you are running a kernel that is still vulnerable after updating to the latest kernel, it may be worth evaluating if you should change to a different kernel stream such has HWE or the stock kernel for your version, even if just temporarily until the patch is ported. (For instance, the FIPS kernel still hasn't been updated at the time of this writing and is vulnerable in all versions including the latest Ubuntu.)
You didn't mention which LTS version you are using or which kernel you are using, or a more specific answer could be given.
