Nearly no distros ship torvald's kernel. They usually take a known really stable release maintained by someone else and then add various patches that torvalds hasn't yet accepted.

When something like this happens they have to take the patches and test them against their kernel.

> Are they independent from torvalds' kernel? I thought the kernel was patched very quickly (KPTI)?

They have to package the kernel for Ubuntu and compile it with whatever modules are standard for them. Plus perhaps applying some distro-specific patches (I don't know if Ubuntu does this), and testing.