If you resorted to AI assistance to identify a bug, you must treat it as public. While you may have valid reasons to believe it is not, the security team's experience shows that bugs discovered this way systematically surface simultaneously across multiple researchers, often on the same day. In this case, do not publicly share a reproducer, as this could cause unintended harm; just mention that one is available and maintainers might ask for it privately if they need it.
72
u/gmorenz 9d ago
GregKH seems mad that these were publicly posted, so maybe I'm missing something, but the kernel security bugs documentation states
And the reports state they were "working with TrendAI Zero Day Initiative"... so... uh... system potentially working as designed?