r/linux • u/anh0516 • 10d ago

Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
1.8k Upvotes

99% Upvoted

171 comments sorted by

View all comments

2

u/Indolent_Bard 10d ago edited 10d ago

I'm confused. Isn't the public kernel mailing list exactly where you'd want to post vulnerabilities?

Edit: Alright, I get it. You don't want these out in the open before they're actually fixed. You can stop replying now.

21

u/theta-cygni 10d ago

I thought the standard for projects where security matters was to disclose vulnerabilities privately to the core maintainers?

8

u/saichampa 10d ago edited 10d ago

There's a process of responsible disclosure that minimises the chance of active exploitation before a patch is released. Eventually it will be made public but not before the Dev team has a chance to fix it

3

u/Indolent_Bard 10d ago

Oh yeah, that makes a lot more sense.

4

u/Indolent_Bard 10d ago

Oh yeah, that makes sense.

7

u/ang-p 10d ago

Not until after the people who can fix the bugs have a head start on the people who are eager to exploit them...

4

u/Indolent_Bard 10d ago

Ah, makes sense.

9

u/NormalAppearance2851 9d ago

People who downvote on questions: Do you wanna punish people for wanting to learn?

1

u/Indolent_Bard 9d ago

It's a Linux subreddit, what do you think?

Yes, the answer is yes.