So CopyFail CVE-2026-31431 is a thing.

[uecker@mastodon.social]

@icing @gregkh Would you consider Debian, arch, gentoo, Redhat, Ubuntu to be worthy?

[icing@chaos.social]

@uecker

You are a troll, Mr Uecker.

@gregkh

[uecker@mastodon.social]

@icing @gregkh Sorry about that, but I find the "nothing could be done" and "responsible disclosure" is dead arguments fairly weak and I do not think that pointing this out is trolling. But let's stop here.

[gregkh@social.kernel.org]

@uecker @icing As is pointed, out, this is just a troll, but seriously, "worthy" isn't the issue. Again, you can not have one group "in" and one "out" without real reasons why anyone is "out".

And again, my point remains, "All early release lists leak like a sieve, otherwise why does your government allow it to exist."

[mormund@mastodon.social]

@uecker In case you are sincere: Is Hannah Montana Linux trustworthy? You also forgot Alpine Linux, Suse and and and and in your list, all of which are "serious" distros. What about Android? They run on billions of devices. But they won't patch anyways. Do they get to be in the club? If you inform all of them you might as well inform everyone.

[uecker@mastodon.social]

@gregkh @icing I think the hostility "just a troll" is not necessary.

[uecker@mastodon.social]

@mormund Sure some of them would seem trustworthy. It might very well be impossible to create a perfect rule about who should or should not be on such a list. But this does not mean that one could not create some reasonable criteria and do a best effort. I disagree with "if you inform some of them you might as well inform everyone" Why should this be the case?

[lioh@social.anoxinon.de]

@wdormann as Greg has pointed out clearly, it is not the responsibility of the Kernel Security team to inform any distro. The funny thing is that Theori, instead of doing that, claims it is not possible anymore and that any distro should instead use (their?) AI tools to spot critical CVEs for the Linux Kernel. This is just a big marketing fuckup.

[lioh@social.anoxinon.de]

@wdormann as Greg has pointed out clearly, it is not the responsibility of the Kernel Security team to inform any distro. The funny thing is that Theori, instead of doing that, claims it is not possible anymore and that any distro should instead use (their?) AI tools to spot critical CVEs for the Linux Kernel. This is just a big marketing trick.

[wdormann@infosec.exchange]

@Lioh
Vulnerability coordination was clearly only an afterthought.

The copy.fail website included screen recordings of 4 Linux distributions being compromised. And at publication time had the audacity to state:

Most major distributions are shipping the fix now.

Narrator: No distribution had prepared a fix at publication time, as no distribution was even aware of the vulnerability.

The irony in all of this: Brian Pak (the Theori CEO) got his infosec fame as part of the PPP group at CMU, which is the home of the CERT/CC.
Bonus irony: Brian applied at the CERT/CC in 2011 for a position on the team that does vulnerability coordination when I was there.

So to spin things as The old model simply doesn’t scale anymore and our best intention was always to improve Linux security is simply laughable. The goal was a successful publicity stunt. Zero F's were given to the Linux users of the planet.

[wagenseil@infosec.exchange]

@wdormann guess it's time to finally update to the latest then