[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <87bjerac9u.fsf@gentoo.org>
Date: Thu, 07 May 2026 08:50:53 +0100
From: Sam James <sam@...too.org>
To: oss-security@...ts.openwall.com
Cc: xw x <v3rdant.xiang@...il.com>
Subject: Re: Linux kernel: KTLS + sockmap "Reverse Order"
Use-After-Free / Data Corruption
Solar Designer <solar@...nwall.com> writes:
> Hi,
>
> V3rdant, CC'ed here, brought this Linux kernel issue to linux-distros on
> March 18, and apparently also to s@k.o at about the same time, citing
> the (outdated) syzkaller "Reporting Linux kernel bugs" instructions:
>
> https://www.openwall.com/lists/oss-security/2026/05/03/2
>
> So we immediately had a coordination problem, which V3rdant acknowledged:
>
> On Wed, Mar 18, 2026 at 10:28:23PM +0000, x xw wrote:
> [...]
> It looks like literally everyone dropped the ball on this issue after
> that point. This includes two distros who had volunteered for:
>
> https://oss-security.openwall.org/wiki/mailing-lists/distros#contributing-back
>
> 9. Stay on top of issues to ensure progress is being made, remind others
> when there's no apparent progress, as well as when the public disclosure
> date for an issue is approaching and when it's finally reached (unless
> the reporter beats you to it by making their mandatory posting to
> oss-security first) - primary: Gentoo, backup: Amazon
>
> I since heard back from Gentoo on this, but no word from Amazon yet.
Indeed. I do think there's a circular element here, which does not
excuse the ball being dropped, but I offer it as a partial explanation:
the current kernel process makes it challenging to keep track of whether
a fix is actually in-flight or whether it's related to a reported
problem. But nonetheless, we should've stayed on top of it with the
reporter.
We're also onboarding another member for the security team as it's just
myself at the moment, and we unexpectedly lost another from illness
recently.
> [...]
sam
Download attachment "signature.asc" of type "application/pgp-signature" (419 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
