So CopyFail CVE-2026-31431 is a thing.

[wdormann@infosec.exchange]

@alcastronic
"Good" is a weird way to describe something that only works on some distributions.

[wdormann@infosec.exchange]

@gunstick
The original (and current) CVE entry is merely the commit message.

Which is unintelligible nonsense for anyone other than a Linux kernel developer.

[joshbressers@infosec.exchange]

@gregkh @deftpunk @wdormann @Viss

It's going to be a wild couple of years

I do think you're right that the traditional disclosure model is gone forever

But this one feels different. It was pretty obvious this was going to be a big one. Most CVEs are extremely lame and will never lead to anything

But some are a big deal. And those can get drown in the great CVE garbage patch

I have no idea what to do about those though, especially in open source

[wdormann@infosec.exchange]

@joshbressers @gregkh @deftpunk @Viss

I get it that a lot of the world uses Linux.

But what if...
In an alternate universe, before publication of the flashy copy.fail writeup with public exploit code, the vulnerability was (for example) reported to the linux-distros mailing list, where the major linux distros are present. And they could hear why this particular vulnerability might want to be on their radar more than the rest of the sea of Linux kernel CVEs? (Universality, reliability, to-be-published exploit code, etc.)

Would this alternate universe be:

[joshbressers@infosec.exchange]

@wdormann @gregkh @deftpunk @Viss

Do I think this would have helped? I'm willing to say it probably wouldn't have hurt. But if the players would have asked for a long embargo, that could have been bad

Not telling the kernel security team is super lame, that should be the minimum bar

[wdormann@infosec.exchange]

@joshbressers @gregkh @deftpunk @Viss

The maximum embargo for said list is 14 days.

[joshbressers@infosec.exchange]

@wdormann @gregkh @deftpunk @Viss

I'm too far removed to know all the process now

4 days is pretty good, yeah

[di4na@hachyderm.io]

@joshbressers @gregkh @deftpunk @wdormann @Viss Here is my take. Just publishing it and letting people catch up, without the "disclosure" is ok.

What is not ok is spreading misinformation and trying to make yourself look bigger than it is, yelling "patch now" when no patch exists, etc

Yeah we need to patch. We know. That is a job for our tooling to tell us. Not the people getting social and possibly marketing clout out of it.

[joshbressers@infosec.exchange]

@wdormann @gregkh @deftpunk @Viss

Ugh, I misread your 14 as a 4 it seems

14 is still pretty good for most things, I won't argue about that

[joshbressers@infosec.exchange]

@Di4na @gregkh @deftpunk @wdormann @Viss

That's also a good point

It's extra frustrating when there's nothing us unwashed masses can do except wait

[di4na@hachyderm.io]

@joshbressers @gregkh @deftpunk @wdormann @Viss I am ok with waiting. That's the job. I am not ok with having to deal with all my management chain coming to me with no context one after the other asking me if we need to panic because they saw it in linkedin.

Or asking me which AI tool we need to buy to find and patch these automatically before they get found, because it is what the marketing in these tell us.

[andrewnez@mastodon.social]

@Di4na @joshbressers you need to buy them all!

[gregkh@social.kernel.org]

@joshbressers @deftpunk @wdormann @Viss Honestly, there was nothing "obvious" about this one being a "big one" compared to all of the bugs we get, and fix, on a daily/weekly basis in the kernel.

The ONLY thing different here from those bugfixes, was that someone made a web site, a simple reproducer, and announced it to the world. For 99.9% of the bugs we fix, that are reproducible like this, no one ever does that. That we know of...

In other words, this was just another Tuesday for us.

[gregkh@social.kernel.org]

@wdormann @joshbressers @deftpunk @Viss Not ALL of the distros are on linux-distros. So that is one thing. The other being that I don't care what happens on linux-distros, for many public reasons I refuse to deal with them anymore, and strongly encourage no one else to do so either.

[wdormann@infosec.exchange]

@Di4na @joshbressers @gregkh @deftpunk @Viss

Yes, the fact that the official advisory said Update your distribution's kernel package and Most major distributions are shipping the fix now when not a single distribution on the planet had an updated kernel package is evidence that the whole publication was a "Look at us!" vehicle, and everybody else on the planet be damned!

I can't say that it's a lie because I can't prove that they knew it was wrong.

Side wonder: Can something written by AI never be called a lie?

[joshbressers@infosec.exchange]

@gregkh @deftpunk @wdormann @Viss

I do wonder sometimes how many of those CVEs you file could be a privilege escalation with a proper reproducer

I'm sure it's not zero

[di4na@hachyderm.io]

@wdormann @joshbressers @gregkh @deftpunk @Viss mostly yes, which is also why I refuse to call it hallucinations or other anthropomorphizing statements... because it just aggregates words together that sounds like they work together.

[gregkh@social.kernel.org]

@joshbressers @deftpunk @wdormann @Viss Loads of them.

[gregkh@social.kernel.org]

@joshbressers @wdormann @deftpunk @Viss What do you mean, they told us, we fixed it, it got in some stable kernels, and so our work on the security team was done. The CVE team assigned a CVE after a while, and even gave it a CVSS score.

The fact that no distro popped up that used older kernel versions to do the real work to backport to older kernels seems to be everyone's major problem here. That is outside of the kernel security team's work entirely. So take it up with the distros that people are paying support for to do this for them?

And yes, Debian was vulnerable, that is not good, and once it was noticed people worked hard and quickly to fix that. Not bad for a community-based distro that no one pays for in my opinion.

[gunstick@mastodon.opencloud.lu]

@wdormann exactly.
If it would say CVSS 7.3 more eyes would have looked (distro maintainers).
If it says "exploit to root available" even more eyes would heve looked.
Instead it is just technobabble to align the dilithium crystals, so nobody knows what it means.