5 ms·

Over 400 Linux CVEs published in the last 24 hours alone

77 points by aghuang 3mo ago

traceroute66 3mo ago
Might need to silently archive those Microsoft Patch Tuesday jokes...
- AdmiralAsshat 3mo ago
  Don't worry, Microsoft is still leading: https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/ https://www.bleepingcomputer.com/news/microsoft/microsoft-ju...
- 1970-01-01 3mo ago
  Those that actually understood security, and weren't on some kind of open-source enforcement mission in life, always knew the "Linux doesn't get viruses" statements would not age well. https://blog.desdelinux.net/en/virus-in-gnulinux-reality-or-myth/#:~:text=The%20architecture%20of%20Unix%20in%20general%20and%20Linux%20in%20particular%20does%20not%20make%20the%20spread%20of%20viruses%20feasible. https://blog.desdelinux.net/en/virus-in-gnulinux-reality-or-...
  - traceroute66 3mo ago
    > Those that actually understood security.... Indeed, and those who actually understood software development always knew vulnerabilities can occur just as easily as bugs. And in some cases more easily than bugs, because many of modern vulnerabilities are so subtle, especially where crypto is involved.
  - kvuj 3mo ago
    You should be careful not to conflate viruses and CVEs. Considering no Linux distro come with an antivirus by default, Linux as a desktop was always extremely vulnerable to bad actors. As a server, I would argue otherwise.
    - thewebguyd 3mo ago
      > Linux as a desktop was always extremely vulnerable to bad actors. Most distros people use as a desktop are alarmingly insecure by default,the security model lags well behind macOS and even Windows (again, by default. You can of course do work to harden it). You lose out on hardware verified boot with signed system volumes, virtualization backed security, granular runtime permissions (apps having full R/W on ~Home, screen recording, microphone access). Immutable distros like Silverblue, flatpak are moving linux desktop security in the right direction but its far from the default, and there are still gaps that need to be closed. We (Linux community) loves to criticize security through obscurity, but that's exactly what most desktop linux users are relying on to not get pwned, relying on marketshare being so low that there just hasn't been that many incidents.
    - 1970-01-01 3mo ago
      Conflated terms because they've been that way for a very long time. If you're being strict, all computer viruses stopped being a problem a decade ago.
- gosub100 3mo ago
  If they were there this whole time but only discovered now, were they really a threat? The reflexive response to this is "those could be exploited for years and we'd never know", but if it was discovered, it obviously wasn't impacting you personally. If they were under lock and key at the NSA and only judiciously used for secret spy BS, that's effectively the same as not existing. Clearly they weren't discovered by all the white hats for this whole time. Also, if Microsoft hypothetically open sourced their code, do you think there would be more, less, or the same number of CVEs? I would guess more. I don't want to go too far to defend Linux. I want to make the case that it has been the more secure OS this whole time.
  - traceroute66 3mo ago
    > I want to make the case that it has been the more secure OS this whole time. Your phone is ringing, caller ID says its Theo de Raadt from OpenBSD. :)
csande17 3mo ago
https://docs.kernel.org/process/cve.html https://docs.kernel.org/process/cve.html > Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team. (And because this happens during the stable release process, there are a lot of 24-hour periods where they issue a ton of CVEs for all the minor bugs fixed in the release.)
alhirzel 3mo ago
I am assuming that many of these are found with automatic analysis tools that are very creative (i.e. LLMs) and there may be a high proportion of very "cornered" cases. I think there needs to be a triage method that would amount to the severity, likeliness, and detection dimensions used to rank risks in a systematic framework [1]. I think if this could be submitted (or estimated) along with such bug reports, it could go a long way toward sustainable intake patterns for this number of possible defects. [1]: https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy...
- petra303 3mo ago
  In my company, the security team isn’t technical. They see CVE, find a vulnerable system, it gets flagged. We have to patch it. We patched for a CVE last week that a malicious usb sound card device could be use the gain root. On a Vm? Is that something we really need to worry about??
  - dboreham 3mo ago
    It's asymmetric warfare. It costs them little to demand a false positive be acted upon, but costs you plenty to refute it.
  - chelmzy 3mo ago
    Its the same at most orgs. Very rare for a vuln remediation program to utilize a truly risk based approach. They would have to trawl through and understand thousands of vulns and the context of your org. There's probably a market for some tool to accomplish this if the larger players haven't attempted already.
  - pudgywalsh 3mo ago
    [flagged]
    - linuxhiker 3mo ago
      Sometimes it is cheaper. Most businesses run on a, "least to be in compliance" model.
PedroBatista 3mo ago
Linus better put his money where mouth is and fire up those AI tokens ASAP. I don't consider this a tragedy, it's just unearthing the reality.
- juliangmp 3mo ago
  What does any of this have to do with AI?
  - PedroBatista 3mo ago
    There has been a long discussion and "conflict" of opinions regarding the use of AI in kernel dev. Linus is pro-AI as a tool ( and I mostly agree, there are consequences however that at least need to be talked about ). That's why I was talking about firing up those AI machines and fix those CVEs ( "make no mistakes" ). But it seems every Linux topic related to security or languages is the ultimate mine field for knee-jerk reactions. :)
st_goliath 3mo ago
I guess very few around here remember the minor fuzz about this from a few years ago? The Linux Kernel Project became their own CNA (CVE Numbering Authority). A CVE is now slapped onto practically every bug fix that is back ported to a stable kernel, resulting in a flood of CVEs. A blog post about this, published at the time: https://sigma-star.at/blog/2024/03/linux-kernel-cna/ https://sigma-star.at/blog/2024/03/linux-kernel-cna/ The title is editorialized (i.e. the OP made it up), the link simply goes to the kernel CVE mailing list archive.
- altairprime 3mo ago
  (Email the mods to clear up the editorial title problem; footer contact link.)
- pseudohadamard 3mo ago
  It's malicious-compliance CVE filing. Other interesting coverage of the issue by Risky Biz, https://news.risky.biz/risky-biz-news-the-linux-cna-mess/ https://news.risky.biz/risky-biz-news-the-linux-cna-mess/. Given the broken nature of the CVE process, see for example Daniel Stenberg of cURL fame's frequent comments on this, I'm undecided whether this is a good thing, a bad thing, or a bit of both.
OsrsNeedsf2P 3mo ago
Amazing how people think this means anything
- rvz 3mo ago
  This sounds like cope. We are going to see more of this with LLMs being able to uncover hundreds of bugs in projects just like Linux.
  - deleted 3mo ago
    [deleted]
  - devmor 3mo ago
    This has nothing to do with LLMs.
    - rvz 3mo ago
      That doesn't excuse the point. Thanks to LLMs, We'll see more of this and more embargoed vulnerabilities now revealed like this on a regular basis. Given that Linux allows the use of AI assistance [0] you'll be very disappointed to see that people will use LLMs to find even more CVEs and bugs much quicker. That also means they will be fixed much quicker which should be a good thing; as long as the core developer is in the loop checking. Unless you are against or downplaying this, you may not know that you are actually coping. [0] https://docs.kernel.org/process/coding-assistants.html https://docs.kernel.org/process/coding-assistants.html
      - worksonmine 3mo ago
        What do you use instead and what makes it more secure?
      - devmor 3mo ago
        Coping with what? Your reply is too full of buzzwords and vague assumptions to understand what point you are trying to make or what you believe you have inferred from me.
catigula 3mo ago
Chinese models, hurray!
- bob001 3mo ago
  You do realize this is an announcement of already fixed issues which were fixed (and not just flagged) weeks or months ago, right? Or are you claiming that Chinese models allow for time travel?
  - deleted 3mo ago
    [deleted]
rwz 3mo ago
Good, it seems like new AI tools would lead to substantially more hardened Linux kernel long term. Until a new generation of AIs finds more bugs.
khurs 3mo ago
All these seem to be by the same person. Go Greg!! https://en.wikipedia.org/wiki/Greg_Kroah-Hartman https://en.wikipedia.org/wiki/Greg_Kroah-Hartman http://www.kroah.com/linux/ http://www.kroah.com/linux/
insanitybit 3mo ago
What people are missing is that these aren't vulnerabilities. The reason you see this is because Greg does not believe in the CVE system. As an act of rebellion, the Linux kernel (a) assigns CVEs to fixes and not bugs, (b) assigns them gratuitously to DoS the system. This is just Greg being a baby. Linux has to be removed as a CNA ASAP, it was a terrible idea to ever grant them that power. This has nothing to do with AI or even security.
sloped 3mo ago
More useful context http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignment-process/ http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignmen... Nothing to panic about.
SAI_Peregrinus 3mo ago
Nearly every bug is at best a denial of service. If the service worked as expected, there wouldn't be any bug. CVSS considers any denial of service a security issue. Therefore, all bugs should have CVE numbers. The Linux team took this to heart, became a CNA, and assigns CVEs to pretty much every bug.
boeroboy 3mo ago
More fuel for the Asterinas kernel, coming for Linux with a purely Rust kernel.
minraws 3mo ago
This should be considered unethical tbh.

77 points by aghuang 3mo ago

traceroute66 3mo ago

Might need to silently archive those Microsoft Patch Tuesday jokes...

AdmiralAsshat 3mo ago
Don't worry, Microsoft is still leading: https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/ https://www.bleepingcomputer.com/news/microsoft/microsoft-ju...
1970-01-01 3mo ago
Those that actually understood security, and weren't on some kind of open-source enforcement mission in life, always knew the "Linux doesn't get viruses" statements would not age well. https://blog.desdelinux.net/en/virus-in-gnulinux-reality-or-myth/#:~:text=The%20architecture%20of%20Unix%20in%20general%20and%20Linux%20in%20particular%20does%20not%20make%20the%20spread%20of%20viruses%20feasible. https://blog.desdelinux.net/en/virus-in-gnulinux-reality-or-...
- traceroute66 3mo ago
  > Those that actually understood security.... Indeed, and those who actually understood software development always knew vulnerabilities can occur just as easily as bugs. And in some cases more easily than bugs, because many of modern vulnerabilities are so subtle, especially where crypto is involved.
- kvuj 3mo ago
  You should be careful not to conflate viruses and CVEs. Considering no Linux distro come with an antivirus by default, Linux as a desktop was always extremely vulnerable to bad actors. As a server, I would argue otherwise.
  - thewebguyd 3mo ago
    > Linux as a desktop was always extremely vulnerable to bad actors. Most distros people use as a desktop are alarmingly insecure by default,the security model lags well behind macOS and even Windows (again, by default. You can of course do work to harden it). You lose out on hardware verified boot with signed system volumes, virtualization backed security, granular runtime permissions (apps having full R/W on ~Home, screen recording, microphone access). Immutable distros like Silverblue, flatpak are moving linux desktop security in the right direction but its far from the default, and there are still gaps that need to be closed. We (Linux community) loves to criticize security through obscurity, but that's exactly what most desktop linux users are relying on to not get pwned, relying on marketshare being so low that there just hasn't been that many incidents.
  - 1970-01-01 3mo ago
    Conflated terms because they've been that way for a very long time. If you're being strict, all computer viruses stopped being a problem a decade ago.
gosub100 3mo ago
If they were there this whole time but only discovered now, were they really a threat? The reflexive response to this is "those could be exploited for years and we'd never know", but if it was discovered, it obviously wasn't impacting you personally. If they were under lock and key at the NSA and only judiciously used for secret spy BS, that's effectively the same as not existing. Clearly they weren't discovered by all the white hats for this whole time. Also, if Microsoft hypothetically open sourced their code, do you think there would be more, less, or the same number of CVEs? I would guess more. I don't want to go too far to defend Linux. I want to make the case that it has been the more secure OS this whole time.
- traceroute66 3mo ago
  > I want to make the case that it has been the more secure OS this whole time. Your phone is ringing, caller ID says its Theo de Raadt from OpenBSD. :)

csande17 3mo ago

https://docs.kernel.org/process/cve.html https://docs.kernel.org/process/cve.html > Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team. (And because this happens during the stable release process, there are a lot of 24-hour periods where they issue a ton of CVEs for all the minor bugs fixed in the release.)

alhirzel 3mo ago

I am assuming that many of these are found with automatic analysis tools that are very creative (i.e. LLMs) and there may be a high proportion of very "cornered" cases. I think there needs to be a triage method that would amount to the severity, likeliness, and detection dimensions used to rank risks in a systematic framework [1]. I think if this could be submitted (or estimated) along with such bug reports, it could go a long way toward sustainable intake patterns for this number of possible defects. [1]: https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy...

petra303 3mo ago
In my company, the security team isn’t technical. They see CVE, find a vulnerable system, it gets flagged. We have to patch it. We patched for a CVE last week that a malicious usb sound card device could be use the gain root. On a Vm? Is that something we really need to worry about??
- dboreham 3mo ago
  It's asymmetric warfare. It costs them little to demand a false positive be acted upon, but costs you plenty to refute it.
- chelmzy 3mo ago
  Its the same at most orgs. Very rare for a vuln remediation program to utilize a truly risk based approach. They would have to trawl through and understand thousands of vulns and the context of your org. There's probably a market for some tool to accomplish this if the larger players haven't attempted already.
- pudgywalsh 3mo ago
  [flagged]
  - linuxhiker 3mo ago
    Sometimes it is cheaper. Most businesses run on a, "least to be in compliance" model.

PedroBatista 3mo ago

Linus better put his money where mouth is and fire up those AI tokens ASAP. I don't consider this a tragedy, it's just unearthing the reality.

juliangmp 3mo ago
What does any of this have to do with AI?
- PedroBatista 3mo ago
  There has been a long discussion and "conflict" of opinions regarding the use of AI in kernel dev. Linus is pro-AI as a tool ( and I mostly agree, there are consequences however that at least need to be talked about ). That's why I was talking about firing up those AI machines and fix those CVEs ( "make no mistakes" ). But it seems every Linux topic related to security or languages is the ultimate mine field for knee-jerk reactions. :)

st_goliath 3mo ago

I guess very few around here remember the minor fuzz about this from a few years ago? The Linux Kernel Project became their own CNA (CVE Numbering Authority). A CVE is now slapped onto practically every bug fix that is back ported to a stable kernel, resulting in a flood of CVEs. A blog post about this, published at the time: https://sigma-star.at/blog/2024/03/linux-kernel-cna/ https://sigma-star.at/blog/2024/03/linux-kernel-cna/ The title is editorialized (i.e. the OP made it up), the link simply goes to the kernel CVE mailing list archive.

altairprime 3mo ago
(Email the mods to clear up the editorial title problem; footer contact link.)
pseudohadamard 3mo ago
It's malicious-compliance CVE filing. Other interesting coverage of the issue by Risky Biz, https://news.risky.biz/risky-biz-news-the-linux-cna-mess/ https://news.risky.biz/risky-biz-news-the-linux-cna-mess/. Given the broken nature of the CVE process, see for example Daniel Stenberg of cURL fame's frequent comments on this, I'm undecided whether this is a good thing, a bad thing, or a bit of both.

OsrsNeedsf2P 3mo ago

Amazing how people think this means anything

rvz 3mo ago
This sounds like cope. We are going to see more of this with LLMs being able to uncover hundreds of bugs in projects just like Linux.
- deleted 3mo ago
  [deleted]
- devmor 3mo ago
  This has nothing to do with LLMs.
  - rvz 3mo ago
    That doesn't excuse the point. Thanks to LLMs, We'll see more of this and more embargoed vulnerabilities now revealed like this on a regular basis. Given that Linux allows the use of AI assistance [0] you'll be very disappointed to see that people will use LLMs to find even more CVEs and bugs much quicker. That also means they will be fixed much quicker which should be a good thing; as long as the core developer is in the loop checking. Unless you are against or downplaying this, you may not know that you are actually coping. [0] https://docs.kernel.org/process/coding-assistants.html https://docs.kernel.org/process/coding-assistants.html
    - worksonmine 3mo ago
      What do you use instead and what makes it more secure?
    - devmor 3mo ago
      Coping with what? Your reply is too full of buzzwords and vague assumptions to understand what point you are trying to make or what you believe you have inferred from me.

catigula 3mo ago

Chinese models, hurray!

bob001 3mo ago
You do realize this is an announcement of already fixed issues which were fixed (and not just flagged) weeks or months ago, right? Or are you claiming that Chinese models allow for time travel?
- deleted 3mo ago
  [deleted]

rwz 3mo ago

Good, it seems like new AI tools would lead to substantially more hardened Linux kernel long term. Until a new generation of AIs finds more bugs.

khurs 3mo ago

All these seem to be by the same person. Go Greg!! https://en.wikipedia.org/wiki/Greg_Kroah-Hartman https://en.wikipedia.org/wiki/Greg_Kroah-Hartman http://www.kroah.com/linux/ http://www.kroah.com/linux/

insanitybit 3mo ago

What people are missing is that these aren't vulnerabilities. The reason you see this is because Greg does not believe in the CVE system. As an act of rebellion, the Linux kernel (a) assigns CVEs to fixes and not bugs, (b) assigns them gratuitously to DoS the system. This is just Greg being a baby. Linux has to be removed as a CNA ASAP, it was a terrible idea to ever grant them that power. This has nothing to do with AI or even security.

sloped 3mo ago

More useful context http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignment-process/ http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignmen... Nothing to panic about.

SAI_Peregrinus 3mo ago

Nearly every bug is at best a denial of service. If the service worked as expected, there wouldn't be any bug. CVSS considers any denial of service a security issue. Therefore, all bugs should have CVE numbers. The Linux team took this to heart, became a CNA, and assigns CVEs to pretty much every bug.

boeroboy 3mo ago

More fuel for the Asterinas kernel, coming for Linux with a purely Rust kernel.

minraws 3mo ago

This should be considered unethical tbh.