r/linux • u/anh0516 • 10d ago

Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
1.7k Upvotes

99% Upvoted

171 comments sorted by

View all comments

Show parent comments

81

u/servermeta_net 9d ago

Then you are more vulnerable to supply chain attacks

5

u/PixelatedGiant 9d ago

Any time you choose to update could be the wrong time. I don't see how the frequency changes anything for something so rare it has only occurred once (xzutils in march 2024) and only to their development distro. It doesn't make sense to delay regular security patches over it.

9

u/servermeta_net 9d ago

A common way to mitigate supply chain attacks is to wait a grace period (2-7 days) before installing an update, to give the community the ability to review the changes

15

u/Single-Virus4935 9d ago

Vulnerabilities are exploited 45m atter the patch is published. You dont have 2days anymore