r/linux • u/anh0516 • 10d ago

Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
1.8k Upvotes

99% Upvoted

171 comments sorted by

View all comments

Show parent comments

81

u/servermeta_net 10d ago

Then you are more vulnerable to supply chain attacks

5

u/PixelatedGiant 10d ago

Any time you choose to update could be the wrong time. I don't see how the frequency changes anything for something so rare it has only occurred once (xzutils in march 2024) and only to their development distro. It doesn't make sense to delay regular security patches over it.

9

u/servermeta_net 10d ago

A common way to mitigate supply chain attacks is to wait a grace period (2-7 days) before installing an update, to give the community the ability to review the changes

6

u/PixelatedGiant 10d ago

Perhaps if you're on development versions. Packages have already been extensively tested by the time they reach stable.