So CopyFail CVE-2026-31431 is a thing.

[gregkh@social.kernel.org]

@uecker @icing There are many reasons why this would not work. Again, step through the logic to prove it yourself.

[krzk@social.kernel.org]

@uecker It's easy to make statements, when you do not want to back them with any sort of argument. Just make a statement and put final stop. Product Foo is insecure. Some car manufactured by Baz is not reliable. This argument is unconvincing. I can express that as well...

[icing@chaos.social]

@uecker

I think I should be the only one on that list. I‘ll then notify the right people who can demonstrate their worthiness.

Wait! That‘s already anthropic‘s business idea. Damn.

@gregkh

[zmanion@infosec.exchange]

@gregkh @joshbressers @wdormann @Viss Because it exists and works better than the alternatives: telling nobody (and waiting to see who notices and when) or telling everybody all at once. If you have regulatory requirements to do or not do something, by all means, follow the regs. I'm not claiming any regs implement sound public CVD policy. Also when there is an external finder, the finder could choose to notify distros or follow other coordination paths, in addition to notifying kernel.org.

(I also understand that it's not quite as simple as just dropping a message on the distros list, and I read a Qualys message explaining that they no longer use distros.)

[uecker@mastodon.social]

@krzk I think this is an unfair accusation. I was pointing out that the argument "it is unclear who to put on the list" by itself is a weak argument. I did not think that this needs further explanation as this seems obvious. Maybe there are good reason why it is difficult to maintain such a list, but the thread I commented on did not include those. In any case, I think it is not help to directly accuse people of "FUD" or misinformation in an evolving discussion.

[uecker@mastodon.social]

@icing @gregkh Would you consider Debian, arch, gentoo, Redhat, Ubuntu to be worthy?

[icing@chaos.social]

@uecker

You are a troll, Mr Uecker.

@gregkh

[uecker@mastodon.social]

@icing @gregkh Sorry about that, but I find the "nothing could be done" and "responsible disclosure" is dead arguments fairly weak and I do not think that pointing this out is trolling. But let's stop here.

[gregkh@social.kernel.org]

@uecker @icing As is pointed, out, this is just a troll, but seriously, "worthy" isn't the issue. Again, you can not have one group "in" and one "out" without real reasons why anyone is "out".

And again, my point remains, "All early release lists leak like a sieve, otherwise why does your government allow it to exist."

[mormund@mastodon.social]

@uecker In case you are sincere: Is Hannah Montana Linux trustworthy? You also forgot Alpine Linux, Suse and and and and in your list, all of which are "serious" distros. What about Android? They run on billions of devices. But they won't patch anyways. Do they get to be in the club? If you inform all of them you might as well inform everyone.

[uecker@mastodon.social]

@gregkh @icing I think the hostility "just a troll" is not necessary.

[uecker@mastodon.social]

@mormund Sure some of them would seem trustworthy. It might very well be impossible to create a perfect rule about who should or should not be on such a list. But this does not mean that one could not create some reasonable criteria and do a best effort. I disagree with "if you inform some of them you might as well inform everyone" Why should this be the case?

[lioh@social.anoxinon.de]

@wdormann as Greg has pointed out clearly, it is not the responsibility of the Kernel Security team to inform any distro. The funny thing is that Theori, instead of doing that, claims it is not possible anymore and that any distro should instead use (their?) AI tools to spot critical CVEs for the Linux Kernel. This is just a big marketing fuckup.

[lioh@social.anoxinon.de]

@wdormann as Greg has pointed out clearly, it is not the responsibility of the Kernel Security team to inform any distro. The funny thing is that Theori, instead of doing that, claims it is not possible anymore and that any distro should instead use (their?) AI tools to spot critical CVEs for the Linux Kernel. This is just a big marketing trick.

[wdormann@infosec.exchange]

@Lioh
Vulnerability coordination was clearly only an afterthought.

The copy.fail website included screen recordings of 4 Linux distributions being compromised. And at publication time had the audacity to state:

Most major distributions are shipping the fix now.

Narrator: No distribution had prepared a fix at publication time, as no distribution was even aware of the vulnerability.

The irony in all of this: Brian Pak (the Theori CEO) got his infosec fame as part of the PPP group at CMU, which is the home of the CERT/CC.
Bonus irony: Brian applied at the CERT/CC in 2011 for a position on the team that does vulnerability coordination when I was there.

So to spin things as The old model simply doesn’t scale anymore and our best intention was always to improve Linux security is simply laughable. The goal was a successful publicity stunt. Zero F's were given to the Linux users of the planet.

[wagenseil@infosec.exchange]

@wdormann guess it's time to finally update to the latest then