2026-05-03T17:30:57Z https://yabu.me Greg K-H https://yabu.me/npub1zqk3v0zd7wsc57tz8zs539ec8vf9wsj7hel02j6hxrwwzkwnlvrsq83mrl https://social.kernel.org/media/3f73cef195c0cb40ddf21ef3842b1c83150d4972f2f9cb5afd5ce09cc8acf07a.blob https://social.kernel.org/media/3f73cef195c0cb40ddf21ef3842b1c83150d4972f2f9cb5afd5ce09cc8acf07a.blob https://yabu.me/nevent1qqsdqft9tat5r0pvzhp76d94sv00nq70mk70yzwm64det4nw425xuzgzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswlqhjen <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub16g6cmy3pla8nq6sapkm650wdn6szn988u87yzxs62jz6ljy50sjq5xs9jn" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Josh Bressers</span> (<span class="italic">npub16g6…s9jn</span>)</a></span> I will quote this in many presentations in the future because it is so true: <br/> <br/>&#34;The Kernel assigns lots of CVEs. They say it’s because they don’t really know how the Kernel is being used, so they err on the side of caution. Companies hate this because they have to deal with a lot of CVEs. Does the Kernel do this because it’s easier or do they have some sort of secret nefarious reason? Probably because it’s just easier and they have zero downside to disclosing and moving on. &#34;<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note19753u3yrn0gdq5awkzal44967c4hyrxcxmyn20rpy20py3c5ypes9s2axy" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1975…2axy</a></span><br/> </div> This post got into my head. I think you're right, the days of coordination are over<br/><br/>So I wrote it down<br/><a href="https://opensourcesecurity.io/2026/05-vulnerability-economics/">https://opensourcesecurity.io/2026/05-vulnerability-economics/</a> </blockquote> 2026-05-03T06:23:28Z https://yabu.me/nevent1qqsvqja6ecf0unau3qr6qchpp6zgympcfjjugwxmvnlpfqz28cv37uszyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw5qccjm In reply to <a href='/nevent1qqst56nacrvlxg7f3zuskur0ekw72mcjal9gkj8dnf8yjguswfm6dssnhra0c'>nevent1q…ra0c</a><br/>_________________________<br/><br/>I love it how people think that &#34;coordination of vulnerabilities&#34; is actually something that can be done these days. Think of just who uses the software in question, and who should, and should not, be on such a list to get a &#34;early disclosure notification&#34;. <br/> <br/>As I have said for quite some time now, all early-disclosure lists are leaks, otherwise why would your government allow them to be in existence? <br/> <br/>Software, and specifically open source software, runs the world. So should the whole world be on that notification list? :) 2026-05-01T08:16:54Z https://yabu.me/nevent1qqsy7k7wr8hpzh999w69wckygul6y4u5qf7uhs9rhxcwlt5m7xlys9szyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw52fylx In reply to <a href='/nevent1qqs8k5pnh7dfgvxh6fv9zlyf5xpf55x9vcsxsn6p6dm7pusyfhzkdwgzfd2wc'>nevent1q…d2wc</a><br/>_________________________<br/><br/>Been there, done that, gave up as I just want to get real work (i.e. kernel stuff) done faster. 2026-04-23T12:34:44Z https://yabu.me/nevent1qqs2xulx64xyvujpnrq7ftnv6tw2m00hnmqcwp3l5hxxe8m88wmtyuszyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswmhzj3y After totally messing up my gdm configuration by foolishly using `gdm-settings` (I didn&#39;t want the machine to suspend at the login screen for obvious reasons that doesn&#39;t play well with logging into it from other boxes), causing it to not properly even show a login screen, I&#39;ve reverted back to running plasma and realizing it&#39;s been a long time since I last ran KDE and how nice it&#39;s gotten since then. <br/> <br/>So, until I figure out how to wipe all gdm settings from the system (hint, I tried the &#34;reset&#34; option on gdm-settings and to blow away all dconf files that i could find on the disk, but odds are I missed something), I guess I&#39;m now a KDE user until I move to a new system... 2026-04-23T12:12:17Z https://yabu.me/nevent1qqs8rda28nkhq6tnesddchn6lujmp0wr992zfj9xadek85jjyrw9aaczyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswsffrje Dear semi-lazyweb, <br/> <br/>Given a git diff of a C/Rust codebase, how to best determine which functions/defines have been modified between the two versions? Yes, the diff itself sometimes gives hints as to what has changed, but it&#39;s not always correct. Think about when it modifies the start of a function, but the diffstat &#34;name&#34; shows the previous function, a correct marking, but not what is needed. <br/> <br/>Is the correct answer really going to be &#34;compile the two versions and compare the AST&#34; or something like that? No &#34;diff library&#34; somewhere that &#34;knows&#34; how to parse C (and Rust) that can do this in a faster way? Surely I&#39;m missing something obvious here... 2026-04-06T10:21:26Z https://yabu.me/nevent1qqsqg87d0e8ffckn5jw2kh4z8n4d6kuj6n270zvpfrnkj8kslc0mlqqzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswv3s8g9 In a few minutes I get interviewed by Shuah Khan and might answer questions from the audience if we have time: <a href="https://www.linuxfoundation.org/webinars/lf-live-maintainer-series-my-life-as-a-linux-kernel-developer-and-maintainer-with-greg-kh-and-shuah-khan">https://www.linuxfoundation.org/webinars/lf-live-maintainer-series-my-life-as-a-linux-kernel-developer-and-maintainer-with-greg-kh-and-shuah-khan</a> <br/> <br/>It will be recorded for playback later as well. It&#39;s part of the great Mentorship video series that Shuah has been putting on for years, the back catalog is deep: <a href="https://events.linuxfoundation.org/lf-live-mentorship-series/">https://events.linuxfoundation.org/lf-live-mentorship-series/</a> 2026-03-31T13:47:55Z https://yabu.me/nevent1qqswegaprn6jn2x2statlxaa3l3cqp4a5cwe6s773f954wlm2f8jxqgzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswr8n6m7 We&#39;ve gotten five different &#34;security reports&#34; about the decades old USBIP protocol <a href="https://docs.kernel.org/usb/usbip_protocol.html">https://docs.kernel.org/usb/usbip_protocol.html</a> and how it is &#34;insecure&#34; in the past few days. <br/> <br/>Yes, it&#39;s only to be run between &#34;trusted&#34; devices, and we will gladly take patches so see the ones recently posted to the linux-usb mailing list to mitigate these issues, but this is very strange as to why all of a sudden this is being reported all at the same time by random different semi-anonymous accounts. <br/> <br/>Is there some big usb-over-ip installation somewhere that people suddenly started caring about out there, or did some internal hacking tool that uses usbip just get leaked? <br/> <br/>No one who we asked &#34;why?&#34; when they submitting these issues would give a very clear answer to that simple question so something is going on... 2026-03-30T06:49:43Z https://yabu.me/nevent1qqsql08n59krshhcsawltfed4w6zsh72uftcyj6kqpy4xcuaj0jnewszyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw3xgnch In reply to <a href='/nevent1qqsfcl7r7ky6wxv3qf75g6mr8zj6ngn96jg24y4tkzfu66wlrgwlccsdyhjp9'>nevent1q…hjp9</a><br/>_________________________<br/><br/>It is real, see my interview in the Register today about this very problem: <a href="https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_kernel/">https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_kernel/</a> 2026-03-27T09:26:55Z https://yabu.me/nevent1qqsrj7muqa8k6ler4wvzrmem2ld3nnkv82y0w4ywgeqy5pty540g8xqzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw9370h5 It was one of those Mondays... <br/> <br/><a href="https://lwn.net/Articles/1059031/">https://lwn.net/Articles/1059031/</a> 2026-02-16T21:14:08Z https://yabu.me/nevent1qqswt9k98c3wcaxj8ezgm66e5z2xv4k283vrl583qt855ys0lqlwueczyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswtewc6x In reply to <a href='/nevent1qqsxgldp3demn9tet83sfg5lkf6vmh4hyfgh00qvwcm5a99zusg3l5g7xu7kz'>nevent1q…u7kz</a><br/>_________________________<br/><br/>If you want a CVE for your CV, come fix a Linux kernel bug! We are giving out 13 CVEs a day, plenty to go around for everyone! :) 2026-02-11T09:49:08Z https://yabu.me/nevent1qqsr9cm36flfkg26wphtvuuzt6yzkrx2yrjgg5zekqsyrj6mmrjgmmqzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw5jk2ss Looks like the AI companies have finally run out of money as they are asking various open source projects to test their closed source products for them for free. What could go wrong with giving access to an unknown tool to private code repos? <br/> <br/>If I didn&#39;t know better, I would think this is an elaborate phishing scam, or they have run out of data to scrape and need more training material. <br/> <br/>Gotta admire their brazenness...<br/> <img src="https://media.social.kernel.org/media/84807b046eac8f56458134f8cb702bb885ab16f63dcba00cc758701a35e79ac7.jpg"> <br/> 2026-02-07T07:35:41Z https://yabu.me/nevent1qqst2cea6cpmnvv2ll24c5gvnuhm34szcjgm85d0vshnrwnd8pxu47qzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw4c2ya7 <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>daniel:// stenberg://</span> (<span class="italic">npub1cm0…enqe</span>)</a></span> It was an amazing honor to receive this, thank everyone so much, and for your great speech at the event.<br/>nostr:note1hu4ezjsj2havj96d569cvxgaaae97349wfjegpayaq32ucqsmvqqls9a4z<br/> 2026-01-30T06:11:34Z https://yabu.me/nevent1qqs9ad4jk76vx9qxnjnmneew44ugp0xm3l6k7n2twm2h8hcey236dkqzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswm9q60f Another post in my Linux kernel CVE process series, &#34;How the Linux kernel security process works&#34;: <a href="http://www.kroah.com/log/blog/2026/01/02/linux-kernel-security-work/">http://www.kroah.com/log/blog/2026/01/02/linux-kernel-security-work/</a> 2026-01-02T15:00:03Z https://yabu.me/nevent1qqstv8ywm9y2dy3mykx5v8jrygnl3x9f8rynw7qtv688rzgxjzdrh4czyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswcdz8ln The kernel CNA assigned their 10000th CVE last week, CVE-2025-68750 <br/> <br/>So far the &#34;stats&#34; look like: <br/>``` <br/> Year Reserved Assigned Rejected A+R Returned Total <br/> 2019: 0 2 1 3 47 50 <br/> 2020: 0 17 0 17 33 50 <br/> 2021: 0 732 24 756 16 772 <br/> 2022: 3 2041 47 2088 0 2091 <br/> 2023: 1 1464 47 1511 0 1512 <br/> 2024: 6 3069 96 3165 0 3171 <br/> 2025: 73 2421 39 2460 0 2533 <br/> Total: 83 9746 254 10000 96 10179 <br/>``` <br/> <br/>Note, the &#34;year&#34; is the year the bug was fixed in the kernel tree, NOT the year the CVE was applied for/assigned. 2025-12-28T12:29:17Z https://yabu.me/nevent1qqst0482lmp9gs9h3vh65qprulgc0cya4xsqvyhsrdeq26qdr7ssknqzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw0l27wm Rust is is not a &#34;silver bullet&#34; that can solve all security problems, but it sure helps out a lot and will cut out huge swatches of Linux kernel vulnerabilities as it gets used more widely in our codebase. <br/> <br/>That being said, we just assigned our first CVE for some Rust code in the kernel: <a href="https://lore.kernel.org/all/2025121614-CVE-2025-68260-558d@gregkh/">https://lore.kernel.org/all/2025121614-CVE-2025-68260-558d@gregkh/</a> where the offending issue just causes a crash, not the ability to take advantage of the memory corruption, a much better thing overall. <br/> <br/>Note the other 159 kernel CVEs issued today for fixes in the C portion of the codebase, so as always, everyone should be upgrading to newer kernels to remain secure overall. 2025-12-16T16:09:42Z https://yabu.me/nevent1qqstd58uz9qrkhzcths5gcszxf0ke6zwyvc2u8dvtlltst0rscemelczyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw25pdee Starting to write up a series of articles about the Linux kernel CVE work that has happened in the past 2 years, starting with some &#34;back to basics&#34; information about how Linux kernels are numbered as many people/companies really don&#39;t know how we do this, and it matters a lot in tracking bugfixes and how to determine &#34;vulnerable&#34; and &#34;fixed&#34; kernel releases: <br/><a href="http://www.kroah.com/log/blog/2025/12/08/linux-cves-more-than-you-ever-wanted-to-know/">http://www.kroah.com/log/blog/2025/12/08/linux-cves-more-than-you-ever-wanted-to-know/</a> <br/>and <br/><a href="http://www.kroah.com/log/blog/2025/12/09/linux-kernel-version-numbers/">http://www.kroah.com/log/blog/2025/12/09/linux-kernel-version-numbers/</a> 2025-12-09T04:43:28Z https://yabu.me/nevent1qqs2wwsr49f4753dge8aw85cstsw3v8r869zndgxl79v5y79lycmn6gzyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswjv6r5l My seat name tag for the EU CRA meeting today...<br/> <img src="https://media.social.kernel.org/media/1cf2ce6ef522658d5cb63bc5f08aea5490eaf1e358ee6e7b42cb290c17dbf3db.jpg"> <br/> 2025-06-04T07:58:37Z https://yabu.me/nevent1qqsgyywjeuxftqn6l5caaq5z9zckvu7qz8vxmz8q3ee7dp90arpjsdszyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswu5hhpv Given the news of the potential disruption of the CVE main server, I&#39;ve reserved 1000 or so ids for the kernel now, which should last us a few weeks. 2025-04-16T07:14:12Z https://yabu.me/nevent1qqsxstrpauqjtd3h5uu487wwnyc8nuckpa79s2m3qsa2y4wwfvkxcgczyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60aswemznjp Scariest cable I have that I actually use. It&#39;s a USB-C to Thinkpad &#34;adapter&#34; that I bought to power a thinkpad that shipped with a giant 135W brick-of-a-power-supply. This cable does work, but has the tendency to &#34;overload&#34; many USB chargers, causing them to reset. Fun times, but good for traveling so I don&#39;t have to lug the brick around with me as well.<br/> <img src="https://media.social.kernel.org/media/6f7f936f6cc23c13cf4f5862d2c7555dce2627cf7d5df9682c063d9af11d4ba8.png"> <br/> 2025-01-27T13:10:54Z https://yabu.me/nevent1qqs8zaja202svqf8c5z79drq6em68d4er5y875llt27msf3ge6938mszyqgz693ufhe6rznevgu2zjyh8qa3y46zt6l8aa2t2ucdec2e60asw84lund This &#34;untrusted data&#34; patch series from Benno Lossin is the result of conversations at last weekend&#39;s Rust Linux kernel conference in Copenhagen: <br/> <br/><a href="https://lore.kernel.org/all/20240913112643.542914-1-benno.lossin@proton.me/">https://lore.kernel.org/all/20240913112643.542914-1-benno.lossin@proton.me/</a> <br/> <br/>It&#39;s not a &#34;silver bullet&#34; for why we should be using rust in the Linux kernel, but it is a &#34;big giant sledgehammer&#34; to help squash and prevent from happening MANY common types of kernel vulnerabilities and bugs (remember, &#34;all input is evil!&#34; and this change forces you to always be aware of that, which is something that C in the kernel does not.) <br/> <br/>I had always felt that Rust was the future for what we need to do in Linux, but now I&#39;m sure, because if we can do stuff like this, with no overhead involved (it&#39;s all checked at build time), then we would be foolish not to give it a real try. <br/> <br/>And yes, I&#39;ve asked for this for years from the C developers, and maybe we can also do it there, but it&#39;s not obvious how and no one has come up with a way to do so. Maybe now they will have some more incentive :) 2024-09-13T12:19:48Z