this post was submitted on 23 Oct 2026
90 points (100.0% liked)

Linux

68226 readers
491 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 7 years ago
MODERATORS
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
90
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List (www.phoronix.com)
submitted 6 hours ago by SocialistVibes01@lemmy.ml to c/linux@lemmy.ml
13 comments fedilink hide all child comments
 

Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list. The vulnerabilities have yet to be patched on mainline but at least in some cases there are patches undergoing testing or queued in "-next" branches. The CVSS scores are as high as 9.0.

Trend Micro's Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list (LKML) rather than the typical private security mailing list. This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list.

Among these newly-disclosed vulnerabilities include:

ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

The bug and security reports keep on coming in the AI fueled world.

you are viewing a single comment's thread
view the rest of the comments
[–] TrickDacy@lemmy.world 1 points 1 hour ago* (last edited 1 hour ago)

with him being a lover and a loud public advocate of it.

I googled the guy's name and as expected, I found him suggesting ai is good for finding bugs now, unlike in the past. No quotes of him praising its use let alone across the board.

I am generally against AI but what exactly is the point of opposing it to the point of denying it has any use whatsoever, exaggerating anything anyone says remotely in favor of it, or in this case making up harm that AI hypothetically may have caused? Doing things like that is just destroying the credibility of opposing AI, and I see this kind of approach to it constantly on here.

No, Linux is not "vibecoded" now. No, Torvalds is not an AI simp now. Yes, there are some uses of AI that are probably worth the downsides (which anyone can see and should admit to). Binary thinking is not productive.