Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 400 Linux CVEs published in the last 24 hours alone

lore.kernel.org

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Over 400 Linux CVEs published in the last 24 hours alone

#31

Post by thewebguyd »

kvuj wrote: post #15
1970-01-01 wrote: post #8

Earlier quoted context omitted.

Those that actually understood security, and weren't on some kind of open-source enforcement mission in life, always knew the "Linux doesn't get viruses" statements would not age well. https://blog.desdelinux.net/en/virus-in-gnulinux-reality-or-...

You should be careful not to conflate viruses and CVEs. Considering no Linux distro come with an antivirus by default, Linux as a desktop was always extremely vulnerable to bad actors. As a server, I would argue otherwise.

> Linux as a desktop was always extremely vulnerable to bad actors.

Most distros people use as a desktop are alarmingly insecure by default,the security model lags well behind macOS and even Windows (again, by default. You can of course do work to harden it).

You lose out on hardware verified boot with signed system volumes, virtualization backed security, granular runtime permissions (apps having full R/W on ~Home, screen recording, microphone access).

Immutable distros like Silverblue, flatpak are moving linux desktop security in the right direction but its far from the default, and there are still gaps that need to be closed.

We (Linux community) loves to criticize security through obscurity, but that's exactly what most desktop linux users are relying on to not get pwned, relying on marketshare being so low that there just hasn't been that many incidents.

Re: Over 400 Linux CVEs published in the last 24 hours alone

#32

Post by theK »

rvz wrote: post #18
OsrsNeedsf2P wrote: post #10

Amazing how people think this means anything

This sounds like cope. We are going to see more of this with LLMs being able to uncover hundreds of bugs in projects just like Linux.

> CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked.

You are right, its over.

On a more serious note. Yes and no. The kernel is secure. It is probably the most scrutinized piece of software in existence. LLMs will find things but most probably they just will help contributors fix bugs.

Re: Over 400 Linux CVEs published in the last 24 hours alone

#33

Post by rvz »

devmor wrote: post #27
rvz wrote: post #18

Earlier quoted context omitted.

This sounds like cope. We are going to see more of this with LLMs being able to uncover hundreds of bugs in projects just like Linux.

This has nothing to do with LLMs.

That doesn't excuse the point. Thanks to LLMs, We'll see more of this and more embargoed vulnerabilities now revealed like this on a regular basis.

Given that Linux allows the use of AI assistance [0] you'll be very disappointed to see that people will use LLMs to find even more CVEs and bugs much quicker. That also means they will be fixed much quicker which should be a good thing; as long as the core developer is in the loop checking.

Unless you are against or downplaying this, you may not know that you are actually coping.

[0] https://docs.kernel.org/process/coding-assistants.html

Re: Over 400 Linux CVEs published in the last 24 hours alone

#34

Post by lousken »

petra303 wrote: post #7
alhirzel wrote: post #4

I am assuming that many of these are found with automatic analysis tools that are very creative (i.e. LLMs) and there may be a high proportion of very "cornered" cases. I think there needs to be a triage method that would amount to the severity, likeliness, and detection dimensions used to rank risks in a systematic framework [1]. I think if this could be submitted (or estimated) along with such bug reports, it could…

In my company, the security team isn’t technical. They see CVE, find a vulnerable system, it gets flagged. We have to patch it. We patched for a CVE last week that a malicious usb sound card device could be use the gain root. On a Vm? Is that something we really need to worry about??

They see their dashboard, when the number is high, they want to get the number low as fast as possible. If the number is close to zero, they want to see zero. It is that simple.

They do not care if the issue is in a piece of code that is never executed and would require full access to the machine. It is there and tool X reports it.

Even security audits are terrible, when they don't find anything major they start reporting stuff that few percent of companies have implemented just to stuff their reports, it is ridiculous.

Re: Over 400 Linux CVEs published in the last 24 hours alone

#35

Post by zenethian »

pudgywalsh wrote: post #21
petra303 wrote: post #7

Earlier quoted context omitted.

In my company, the security team isn’t technical. They see CVE, find a vulnerable system, it gets flagged. We have to patch it. We patched for a CVE last week that a malicious usb sound card device could be use the gain root. On a Vm? Is that something we really need to worry about??

[flagged]

That’s a pretty insane leap to go from “we have a non-technical security team” to “DEI caused this.”

Re: Over 400 Linux CVEs published in the last 24 hours alone

#36

Post by PedroBatista »

juliangmp wrote: post #14
PedroBatista wrote: post #6

Linus better put his money where mouth is and fire up those AI tokens ASAP. I don't consider this a tragedy, it's just unearthing the reality.

What does any of this have to do with AI?

There has been a long discussion and "conflict" of opinions regarding the use of AI in kernel dev.

Linus is pro-AI as a tool ( and I mostly agree, there are consequences however that at least need to be talked about ). That's why I was talking about firing up those AI machines and fix those CVEs ( "make no mistakes" ).

But it seems every Linux topic related to security or languages is the ultimate mine field for knee-jerk reactions. :)

Re: Over 400 Linux CVEs published in the last 24 hours alone

#37

Post by thewebguyd »

petra303 wrote: post #7
alhirzel wrote: post #4

I am assuming that many of these are found with automatic analysis tools that are very creative (i.e. LLMs) and there may be a high proportion of very "cornered" cases. I think there needs to be a triage method that would amount to the severity, likeliness, and detection dimensions used to rank risks in a systematic framework [1]. I think if this could be submitted (or estimated) along with such bug reports, it could…

In my company, the security team isn’t technical. They see CVE, find a vulnerable system, it gets flagged. We have to patch it. We patched for a CVE last week that a malicious usb sound card device could be use the gain root. On a Vm? Is that something we really need to worry about??

This is the rot that's happening in cybersec. Before we even had security teams as a dedicated role, sysadmins mostly handled security, and we would evaluate each CVE and determined if it even was applicable.

Then companies started hiring paper pushers into security roles and discretion no longer mattered, it just became a game of "Check the box" with no regard for what is actually running in prod, or whether you're actually vulnerable.

Same shit with auditors. I deal with PCI and it's a fight to explain why the "compensating controls" work to a non technical auditor. If it doesn't check the box exactly, good luck.

Re: Over 400 Linux CVEs published in the last 24 hours alone

#38

Post by 1970-01-01 »

kvuj wrote: post #15
1970-01-01 wrote: post #8

Earlier quoted context omitted.

Those that actually understood security, and weren't on some kind of open-source enforcement mission in life, always knew the "Linux doesn't get viruses" statements would not age well. https://blog.desdelinux.net/en/virus-in-gnulinux-reality-or-...

You should be careful not to conflate viruses and CVEs. Considering no Linux distro come with an antivirus by default, Linux as a desktop was always extremely vulnerable to bad actors. As a server, I would argue otherwise.

Conflated terms because they've been that way for a very long time. If you're being strict, all computer viruses stopped being a problem a decade ago.

Re: Over 400 Linux CVEs published in the last 24 hours alone

#39

Post by pixl97 »

bob001 wrote: post #23
alhirzel wrote: post #4

I am assuming that many of these are found with automatic analysis tools that are very creative (i.e. LLMs) and there may be a high proportion of very "cornered" cases. I think there needs to be a triage method that would amount to the severity, likeliness, and detection dimensions used to rank risks in a systematic framework [1]. I think if this could be submitted (or estimated) along with such bug reports, it could…

The linux kernel team disagrees with your approach but what do they know? > Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This…

That with LLMs being decent at chaining exploits suddenly very difficult issues can be accomplished by people with middling abilities and resources.

Re: Over 400 Linux CVEs published in the last 24 hours alone

#40

Post by insanitybit »

What people are missing is that these aren't vulnerabilities. The reason you see this is because Greg does not believe in the CVE system. As an act of rebellion, the Linux kernel (a) assigns CVEs to fixes and not bugs, (b) assigns them gratuitously to DoS the system.

This is just Greg being a baby. Linux has to be removed as a CNA ASAP, it was a terrible idea to ever grant them that power.

This has nothing to do with AI or even security.

Post reply on HN