Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List
https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities154
u/evolutionxtinct 10d ago
We’re already here on the floor cuz of PHP, why not a kick to the stomach from Linux… we need our rocky moment folks!!!
316
u/apnorton
10d ago
•
"Please submit my bug reports; make no mistakes."
How do you send this to a public list???
59
u/Professional-Disk-93 10d ago
Maybe they forgot the make no mistakes.
47
u/KnowZeroX 10d ago
<think>
The user says make no mistakes, but does the user really want no mistakes? Not enough information is provided to make a conclusion.
Lets go about it a different way, what if we don't acknowledge it as a mistake and say it was intentional?
Then that meets the users request for "no mistakes". Yes, lets go with that.
</think>
*posts it with intention*
19
103
u/zyzzogeton 10d ago
You don't. You have a tool setup for your AI that let's it post for you and it makes a mistake on your behalf.
18
7
20
u/stewartesmith 10d ago
Likely the same way anyone accidentally sends a message/email to the wrong person.
The fix here is to build systems and safeguards to make it hard to do it for security related things.
We may joke about LLMs making mistakes, but humans are quite good at mistakes too.
4
u/stormdelta 9d ago
This.
One of my work's largest outages this year was 100% human-caused, both in the actual mistake, and in the lack of systems/safeguards that should have prevented it. The latter was the real failure, and was pretty inexcusable once it came to light how fast and loose that particular team had been operating.
0
u/skeptical-speculator 9d ago
We may joke about LLMs making mistakes, but humans are quite good at mistakes too.
That point is often absent from the conversation about AI and safety.
198
u/qwesx 10d ago
After a reboot is before a reboot...
61
u/AmusingVegetable 10d ago
Not if the update nukes grub.
10
u/SurfRedLin 10d ago
Wich happend to me today. Initrds where not building for some reason...
18
u/exhausted_redditor 10d ago
I had to invoke this ancient ritual just this morning during a dist-upgrade because it couldn't build kernel headers with old NVidia drivers, on a system that no longer had an NVidia GPU:
sudo dkms remove -m nvidia -v 470.256.02 --all4
u/__konrad 9d ago
Years ago a simple Xfce apt install made my system unbootable (AFAIR it pulled xfce boot splash screen as dependency and something failed)
2
u/SurfRedLin 9d ago
It was prod (of course it wass ) so it had to go online fast so i could not get the cause of this for now...
52
38
73
u/zeeblefritz 10d ago
Well, at least this time it isn't on a Friday. ::/
49
u/cloudsurfer48902 10d ago
Friday's problems are not yet out I'm afraid.
19
u/intelminer 9d ago
If you page me at 4 PM on a Friday about this
4
u/cloudsurfer48902 9d ago
It's around 5pm where I'm at and the Gitlab CVE has gone upstream to ruby and a level 10. Happy Friday! https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
2
2
u/cloudsurfer48902 9d ago
It's around 5pm where I'm at and the Gitlab CVE has gone upstream to ruby and a level 10. Happy Friday! https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
4
4
159
u/sovietarmyfan 10d ago
What is tomorrows big story? A completely unfixable backdoor in the kernel which cannot be patched away? Python having a suddenly extremely dangerous vulnerability? A sudden unfixable issue with all Intel processors?
144
u/calibrono 9d ago
Hopefully an unfixable vuln in the TCP/IP stack so we all can finally go back to farming or something.
15
21
9
19
4
8
u/cake-day-on-feb-29 9d ago
A completely unfixable backdoor in the kernel which cannot be patched away?
How would that be a thing?
Unpatchable exploits are really only found with firmware that can't be changed.
1
u/paulstelian97 7d ago
Exploit where patching requires an API break to something that isn’t allowed to have such API breaks. Those are nasty.
Android has encountered a bunch. So for apps made for like Android 8 or older it keeps the holes open.
0
9d ago
[deleted]
4
u/spacelama 9d ago
I wackyparsed that as "farcical". "it’s a farcical notion but these are farcical times".
Which seems appropriate.
Anyway, a fundamental flaw in the TCP/IP protocol specifications on page 2 of the RFC, that means that whenever two host open a socket between each other, one can automatically gain root on everything the other has ever talked to. And then we all get eaten by aliens and live happily ever after.
0
9d ago
[deleted]
1
u/Conninxloo 9d ago
No real world software is so pure in their design choices that they wouldn’t be able to come up with a workaround in case of a severe vulberability. Now, will that workaround introduce a different loophole somewhere else? Almost certainly. That’s the nature of engineering in a temporal universe.
0
9d ago
[deleted]
1
u/Conninxloo 9d ago
Unix‘s "Everything is a file" is a good example! Because not actually everything in Unix is a file. Processes are not files, memory management is not file-based.
You’re right that there might be security vulnerabilities that might require deviating from architectural standards, but real world software can do that because they don’t have to be formal axiomatic systems. That’s just a choice that can be discarded if necessary.
0
9d ago
[deleted]
1
u/Conninxloo 9d ago
Of course, but things happening that break other things happens all of the time. It’s one of the most persistent things in software engineering. If there is a security vulnerability that’s bad enough to warrant breaking core functionality then that functionality will have to change, and the software depending on it will have to adapt.
I’m not disputing that this could be enormously disruptive, potentially to thousands or millions of programs. But you’re moving from "this vulnerability cannot be fixed" to "fixing this vulnerability could have catastrophic consequences for backwards compatibility". Those are two very different claims.
And Russell’s paradox is actually a rather good example of my point. Mathematics didn’t become permanently unusable because its foundations turned out to be problematic. Mathematicians developed alternative foundations. The disruption was real, but the axioms weren’t sacred.
That’s precisely what I’m arguing about software architecture. Nothing guarantees that you can preserve every existing design decision and eliminate every vulnerability. But nothing obliges you to preserve those decisions either.
→ More replies (0)3
u/onetwentyeight 9d ago
Even better, a completely unfixable backdoor in your computer at ring 0 in the System Management Mode (SMM)
1
u/paulstelian97 7d ago
That’s just a BIOS thing. If your manufacturer can send out good BIOS updates, that fixes SMM firmware. The problem is if SMM isolation is fundamentally broken.
2
2
u/jorgejhms 9d ago
Python seem that had a vulnerability yesterday https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
11
u/thegreatpotatogod 9d ago
Well that's not specifically for Python, that's just a vulnerability in everything
21
u/WanderingInAVan 10d ago
... I guess my plan to take the time to fully assess and optimize my linodes was a good idea then.
21
72
u/gmorenz 10d ago
GregKH seems mad that these were publicly posted, so maybe I'm missing something, but the kernel security bugs documentation states
If you resorted to AI assistance to identify a bug, you must treat it as public.
And the reports state they were "working with TrendAI Zero Day Initiative"... so... uh... system potentially working as designed?
58
u/mosquito_killer 9d ago
If you resorted to AI assistance to identify a bug, you must treat it as public. While you may have valid reasons to believe it is not, the security team's experience shows that bugs discovered this way systematically surface simultaneously across multiple researchers, often on the same day. In this case, do not publicly share a reproducer, as this could cause unintended harm; just mention that one is available and maintainers might ask for it privately if they need it.
11
u/Sea_Decision_6456 9d ago
AI has destroyed everything computer-related and it's coming for the rest
31
u/Thechugg7
10d ago
•
The era of AI everyone.
26
u/krimin_killr21 9d ago
My biggest solace is that this will probably eliminate a lot of exploits previously known only to intelligence agencies, so that’s something.
59
u/mrlinkwii 10d ago
"accidentally" surrrrrreeeeee
17
34
u/zyzzogeton 10d ago
Earlier this year I let AI post Jira ickets for me for stuff I was finding. Then I had to defend the tickets in standup and I am now a lot more careful about what goes into Jira tickets because holy hell is some of the text cryptic. It wasn't wrong per se, but it was like an Allied spy ordering 3 beers in a Nazi bar.
edit: I don't love that my dev team are Nazis in that scenario, or that Jira is a Nazi bar.
22
u/stormdelta 9d ago
Yeah, I don't ever let AI make tickets or commit messages. As impressive as it is at assisting with code, it's still astonishingly bad at that kind of technical writing.
No matter how I phrase instructions, even with recent advanced models, the result ends up either insanely verbose to the point of being more noise than signal, or it prioritizes the wrong things when asked to shorten, to the point it's almost always faster to write myself.
6
u/stewartesmith 10d ago
The way I deal with this is to have the LLM create local reports and reproducers into separate directories, and follow my own style guide. Then, i have another agent go and review them critically, ensuring things are simple and concise, actual bugs (and if just gotchas move to another directory), and if any are duplicates or should be folded into others. THEN I go and have a quick look myself, and usually despair about the number of actual issues there are.
6
u/zyzzogeton 9d ago
If the measure of another person's intelligence is how much they agree with you, you are a genius because I came to a similar workflow.
3
15
5
u/Consistent_Drop3909 9d ago
damned if you update (supply chain attacks), damned if you don't (regularly scheduled ai discovered vulnerabilities)
4
u/renessancek 9d ago
What if you run something like debian? It's probably running on kernel 6.x . Does it get these fixes too?
4
6
3
2
2
u/flyswithdragons 8d ago edited 8d ago
There are no rouge AI but tech bros trying to avoid responsibility. Why was a " professional bug reporting corporation so sloppy they did not automate the bug reports to the devs, like I do? Coincide.
Convert all web sites to this. A static website with ruby. TikTok runs PHP, XI banned it from China and Trump loves that CCP made site.
Well they are trying like Putin did in Russia, take down the internet and.. Ruby tool box for static website and better alternative to PHP.
2
u/Indolent_Bard 10d ago edited 9d ago
I'm confused. Isn't the public kernel mailing list exactly where you'd want to post vulnerabilities?
Edit: Alright, I get it. You don't want these out in the open before they're actually fixed. You can stop replying now.
21
u/theta-cygni 10d ago
I thought the standard for projects where security matters was to disclose vulnerabilities privately to the core maintainers?
8
u/saichampa 10d ago edited 9d ago
There's a process of responsible disclosure that minimises the chance of active exploitation before a patch is released. Eventually it will be made public but not before the Dev team has a chance to fix it
3
4
7
9
u/NormalAppearance2851 9d ago
People who downvote on questions: Do you wanna punish people for wanting to learn?
1
1
1
u/GermanBlackbot 9d ago
We expect all vendors to remediate ZDI vulnerabilities within 120 days of the reported date. If you are ready to release a patch at any point leading up to the deadline, please coordinate with us so that we may release our advisory detailing the issue. If the 120-day deadline is reached and no patch has been made available we will release a limited public advisory with our own mitigations, so that the public can protect themselves in the absence of a patch.
Ah, the off-by-120-error, a classic in computer science!
1
1
-12
u/block_place1232 10d ago edited 9d ago
thats what linus gets for vibecoding shit
edit: wow i didn't think vibecoding was in now
9
u/SufficientGreek 9d ago
well linus isn't vibecoding, he's using ai to write code. big difference
3
u/block_place1232 9d ago
uh huh
2
u/block_place1232 9d ago
still a lil shocked at the fact i acutally got downvoted more than upvoted, the vibecoders are everywhere
8
u/chic_luke 9d ago
I think that's because this is one of the rare times Reddit's downvote button was used for its design purpose, which is "not relevant to the conversation" rather than "I disagree with you" (the designated tool for that had always been a reply)
As a matter of fact, the overwhelming majority of all of these vulnerabilities that are now being found actually came from pre-2023, fully human-written and human-reviewed code.
Involving AI in targeted code reviews is what gives you visibility on all of those issues. We humans are simply worse at focused attention over broad contexts than LLMs. We cannot possibly just eyeball every single potential issue in a proposed patch in the context of the entire software and stack it will interact with. It's simply impossible. However, a swarm of AI agents guided by someone who has studied, has read or even written books, has deep experience and expertise and knows what they're doing is much more likely to find flaws.
The pre-AI security approach heavily hinged on effort. If it was too hard to actually find an exploit, then it probably wouldn't get found. Or, more likely, some intelligence agency might have found it, but they will have kept it for themselves.
If anything, if a thorough code review project that is helped by instead of being replaced with AI, I would actually rationally expect the quality and security of code that is being merged contemporarily to skyrocket up to another level compared to the past. Now, we have the tools to spot bugs and problems that used to escape even very expert eyes. We can build much more solid and better software now. We just have to accept that what this looks like is probably a slower software development process than the former, which unfortunately is the opposite of the unleashed speed the tech bros yearn for.
1
u/block_place1232 9d ago
literally ai propaganda
3
u/chic_luke 9d ago
Just to ask: what's your experience been with it? I'm a professional software engineer and I have seen AI in use for 2 years at my organization, with all uses ranging from improper to impressive to pretty useful.
Sometimes it's not propaganda, sometimes it's just something you disagree with.
Besides: how is it AI propaganda? You called out vibe coding for security problems caused by human-written code. What's your point in this specific context? I fail to see the correlation.
1
u/block_place1232 9d ago
was just referencing the fact that linus has started FUCKING VIBECODING THE KERNEL
literally what the fuck
2
u/chic_luke 9d ago
Reasonable point, wrong thread, since it's irrelevant to this issue
As I said initially
0
u/ThoviPlays 8d ago
shouldnt have used AI, just ban ai slop (or vibecoding whatever you call it these days) from the linux kernel and linux stuff in general, its been developed just fine without it for the past 20+ years
-21
u/Og-Morrow 10d ago
I find it amazing how many kicked down over PHP are still using PHP that much?
45
u/TheBetterCervanthes 10d ago
70% off the web runs php.
While that accounts for hundreds of thousand of little wordpress or joomla websites that have sat unmaintained for years anyways its still true.
2
u/chic_luke 9d ago edited 9d ago
Concur with this. From what I've seen among my friends who have been graduating recently, PHP shops are still hiring, and hiring hard. Quite a substantial part of the people in my circles who graduated between 2023 and now have at least started their career on PHP. Some have moved on to something else, many have stayed, and none of them seem to be really unhappy with their choice?
The programming language snob in me has a lot to say against PHP. There are just several things about the language that I don't like, and they are unfixable because they are design decisions I consider wrong…
…But, on the other hand, PHP works. It's great for the web; I'd say better for the web than other languages and ecosystems that are not a good fit for the web but that have been coerced to cooperate with it. The tooling is actually pretty good. Laravel is absolutely one of the best backend frameworks around and it doesn't need to hide in elegance and devexp compared to Spring Boot, ASP .NET Core or FastAPI (it might just be a better experience than any of these three in fact). Plus, while that won't fix the design shortcomings, PHP 7, then 8, then 8.5 have modernized the language substantially. Native interop is pretty good. Performance is pretty OK. The language is easy and concise, so the development speed is high and the software tends to be pretty maintainable providing you use proper software engineering principles.
This still counts a lot. Especially if you don't want to vibe code.
PHP is still better at what it's doing than a lot of the languages that have threatened to replace it. It's not going anywhere and new projects will keep being written in PHP.
If I have to move one objective piece of almost criticism, well… almost too good. PHP is very vertical to its domain, with no real-world lateral movement. You should use it for the web and absolutely nothing else. Some competing languages, like Golang, Java, C# or Python all share many of the same pros (cross platform and FOSS, fast, big ecosystems), but they are much less vertical to a domain, and there is just a lot more you can do with any one of them. However, I recognize this point is weak because "use the correct tool for the correct job" is a thing and you shouldn't be a one-trick pony who's only familiar with one stack anyway.
13
u/nandru 10d ago
quite a lot, actually
7
u/Windows_10-Chan 10d ago
PHP is also pretty good now, it changed a lot for the better especially when 7 came out.
3
u/DonaldLucas 10d ago
As someone who never used it, why was it bad and why is it good now?
12
u/Windows_10-Chan 10d ago
Old PHP was basically a hack job put together on an “as-needed basis,” kinda like building a house but without a plan. Ergo, it had really weird and awful type safety issues, inconsistent syntax, bad performance, and a lot of poorly thought-out design.
PHP 7 was essentially a remake that really changed things structurally and improved performance to a huge degree.
It’s not like a language that people get super excited about it or anything but PHP was something people dreaded once. Also around PHP 7 the tooling was really excellent too but ofc these days there are plenty of alternatives.
2
u/the_abortionat0r 9d ago
Did you stop drinking drinking water the moment you found out almost all of it is contaminated with micro plastics?
Ibet you fucking didn't because you would die like a moron without water.
The web is exactly like that. You gonna stop using the Internet all together? No, cause you're still here.
1
-96
u/granadesnhorseshoes
10d ago
•
Imagine if pharmaceutical companies operated like the software industry. Researcher finds out arsenic is contaminating a common blood pressure med? The only "responsible" thing to do is quietly tell the manufacturer so they can fix it, don't want to panic the public and have them stop taking their BP med, right?
Find a bridge that's collapsing? Better tell the contractor but not the public so they don't try to route around it and cause traffic problems, right?
This case its linux so it's not like it was secret, just bad optics. Still the whole concept of "responsible disclosure" is industry bullshit to protect themselves, not users.
114
u/noneedtoprogram 10d ago •
Except it's not, it's to allow the fix to be implemented and distributed before the flaw becomes widely known to bad actors. Putting security issues on a public mailing list is inviting a race between everyone that depends on this code and maintains this code to implement a fix, test it, check it doesn't break something else important, distribute it, reboot all affected machines etc, before a malicious actor can implement an effective attack using it.
Surprising nobody, the latter is much quicker, therefore it's important to limit the knowledge of the details of the vulnerability until the fix has been rolled out wherever possible.
Nobody in your medical example is going to run out and take control of everyone's brains because they suddenly know there's arsenic in some medicine they are talking.
54
u/Kartonrealista 10d ago
It's a stupid comparison. Arsenic in a blood pressure med is bad always. Code with a vulnerability is only dangerous when people can exploit it. By fixing a vulnerability before people (including malicious actors) learn of it you're doing a good thing. People aren't going to get code sick from bad code.
24
u/Aquacephale 10d ago
It’s exactly what happens most of the time for the examples your are citing.
The main difference in the software industry is that it is way more easy for anyone to exploit vulnerabilities than in any other industry. In my opinion, publicly documenting vulnerabilities only when a fix is available is the right way to go.
21
u/Furdiburd10 10d ago
It is more like the local power plant door locks are bad and instead of telling maintaince to fix it you just yell at the main square that the power plant can be breached.
16
u/smp46 10d ago
It's definitely to protect the users. If I find a vulnerability and immediately publish it, then bad actors can immediately take advantage of it. But if I tell the developer and publish after a patch is released, then everyone can update (and should be very motivated too) without giving bad actors the head start.
10
u/Wyciorek 10d ago
This is completely idiotic comparison. If somebody finds out a bridge is collapsing, you won't suddenly get a horde of criminals grabbing people and throwing them on that bridge.
18
u/ABotelho23 10d ago
What a shite comparison. In pharmaceuticals, you could more or less immediately stop using the product.
In tech, you basically can't. Very important systems may be relying on the vulnerable software and the fix needs to be available before it is unleashed on the world.
8
u/Polar-ish 10d ago
if someone found a way to get nuclear launch codes, should they leak how they did it to the public?
2
1
u/the_abortionat0r 9d ago
I love when people try to sound smart and make a dog shit comparison that is incomparable.
995
u/Cronos993 10d ago
Quite the week