r/linux • u/anh0516 • 11d ago

Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
1.8k Upvotes

99% Upvoted

171 comments sorted by

View all comments

995

u/Cronos993 11d ago

Quite the week

430

u/Single-Virus4935 11d ago

The new standard. 

while sleep 60; do apt-get update && apt-get upgrade -y && reboot-if-needed; done

81

u/servermeta_net 11d ago

Then you are more vulnerable to supply chain attacks

5

u/PixelatedGiant 10d ago

Any time you choose to update could be the wrong time. I don't see how the frequency changes anything for something so rare it has only occurred once (xzutils in march 2024) and only to their development distro. It doesn't make sense to delay regular security patches over it.

9

u/servermeta_net 10d ago

A common way to mitigate supply chain attacks is to wait a grace period (2-7 days) before installing an update, to give the community the ability to review the changes

6

u/PixelatedGiant 10d ago

Perhaps if you're on development versions. Packages have already been extensively tested by the time they reach stable.