Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 Mar 2024 14:41:27 +0100
From: Vegard Nossum <>
Subject: Re: CVEs issued by the Linux kernel CNA

On 21/02/2024 00:30, Alan Coopersmith wrote:
> As recently announced [1], is now a CNA for the Linux kernel, 
> and
> today issued its first 8 CVEs, as seen in the archives of their mailing 
> list
> at .
> Their documentation [2] warns that we should expect a "seemingly large 
> number
> of CVEs that are issued by the Linux kernel team".
> Since there's already an archived mailing list covering the CVE 
> assignments,
> I don't think it makes sense to mirror that large amount of traffic 
> here, but
> to only bring to oss-security those that are especially interesting or 
> useful
> to discuss further.  What do others think?
> [1]
> [2]

Related to this, I've submitted an RFC patch for a document (aimed at
distributions) describing how to assess kernel patches for security
impact and indirectly proposing a way to reduce the workload:

I wanted to share the link here as 1) some distributions may not have
seen the original posting, and 2) it may be of some general interest to
others on here.

If you have feedback, please reply to the linked thread.



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.