this post was submitted on 29 Sep 2026

316 points (99.1% liked)

linuxmemes

32928 readers

959 users here now

Hint: :q!

Sister communities:

Community rules (click to expand)

1. Follow the site-wide rules

Instance-wide TOS: https://legal.lemmy.world/tos/
Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html

2. Be civil

Understand the difference between a joke and an insult.

Do not harrass or attack users for any reason. This includes using blanket terms, like "every user of thing".

Don't get baited into back-and-forth insults. We are not animals.

Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.

Bigotry of any kind will not be tolerated. This is an LGBTQ+-friendly community -- if that is a problem for you, you should leave.

3. Post Linux-related content

Including Unix and BSD.

Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of sudo in Windows.

No porn, no politics, no trolling or ragebaiting.

Don't come looking for advice, this is not the right community.

4. No recent reposts

Everybody uses Arch btw, can't quit Vim, <loves / tolerates / hates> systemd, and wants to interject for a moment. You can stop now.

5. 🇬🇧 Language/язык/Sprache

This is primarily an English-speaking community. 🇬🇧🇦🇺🇺🇸

Comments written in other languages are allowed.

The substance of a post should be comprehensible for people who only speak English.

Titles and post bodies written in other languages will be allowed, but only as long as the above rule is observed.

6. (NEW!) Regarding public figures

We all have our opinions, and certain public figures can be divisive. Keep in mind that this is a community for memes and light-hearted fun, not for airing grievances or leveling accusations.

Keep discussions polite and free of disparagement.

We are never in possession of all of the facts. Defamatory comments will not be tolerated.

Discussions that get too heated will be locked and offending comments removed.

Please report posts and comments that break these rules!

Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't remove France.

founded 3 years ago

MODERATORS

zephyr@lemmy.world

rtxn@lemmy.world

316

https://lists.debian.org/debian-security-announce/2026/msg00441.html (lemmy.blahaj.zone)

submitted 1 day ago by not_IO@lemmy.blahaj.zone to c/linuxmemes@lemmy.world

50 comments fedilink hide all child comments

https://lists.debian.org/debian-security-announce/2026/msg00441.html

top 50 comments

sorted by: hot top controversial new old

[–] sem@lemmy.blahaj.zone 7 points 12 hours ago

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

For the stable distribution (trixie), these problems have been fixed in
version 6.12.111-1.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/linux

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[–] Impractical_Island@lemmy.world -1 points 9 hours ago

Will someone touch me? I'll touch you in return. I am not lost.

[–] rickdg@lemmy.world 12 points 1 day ago (1 children)

From the image, I thought this was an omarchy meme.

[–] someone@lemmy.today 3 points 10 hours ago

Can we please stop making fun of omsloppy already?

[–] carrylex@lemmy.world 89 points 1 day ago (4 children)

Are these real vulnerabilities or are these "When Mars and Jupiter are aligned next to each other and you compile the kernel backwards X might crash" ones?

[–] droans@lemmy.world 10 points 10 hours ago

We use Copilot to review PRs at work. It loves these kinds of scenarios.

The other day, I was adjusting a drop-down site filter to only show options that would work for the given user. It threw up a "critical vulnerability alert" complaining that I "validated" the user's selection based on all options, not just the ones they can view.

First off, it wasn't validation. It was me getting the value of the option. Second, they literally couldn't do anything if they did select one of those options. And third, the user could bypass it about a dozen other ways, even if I designed it to be a validator.

[–] Feathercrown@lemmy.world 6 points 10 hours ago

142 critical vulnerabilities

checks inside

denial of service only

[–] jj4211@lemmy.world 8 points 12 hours ago (1 children)

Yeah, CVEs are usually nothing when you get down to understanding, especially kernel CVEs, which almost always declares a CVE for almost any bug, because it is easier that trying to think if it is a security issue or not and basically just assume it could be.

Huge pain as in my work we have a security policy where any unpatched CVEs that cannot be updated away must have a fairly significant writeup delving into the nuance of the CVE and what mitigation has been applied or a rationalization of why it isn't a risk and by policy we have to second guess every CVE assessment from our vendor, who we explicitly pay to triage and fix this stuff so we don't have to... They used to at least allow us a pass on "low severity" (that's still pretty flawed), but they decided that didn't sound "tough" enough and now every single one must have an answer. So every month a few people have to spend a few days just reading tons of CVEs that are not yet (and frequently never will be) patched by vendor and rationalize it away for the security team. Sometimes the security team will get odd and demand we build our own from upstream (most recently, vim of all things we were mandated to build from source).

[–] apftwb@lemmy.world 5 points 9 hours ago

I'm so sorry. I hope the pay is good.

[–] BeatTakeshi@lemmy.world 55 points 1 day ago (1 children)

Like the tide, only the moon affects kernel compilation

[–] pticrix@lemmy.ca 25 points 1 day ago (1 children)

Hate to break it to you, but the sun also affects tides.

Tap for spoiler

[–] BeatTakeshi@lemmy.world 12 points 1 day ago (1 children)

Gravity equation says everything with a mass does... Compiling Gentoo removes the sun from the equation anyway (I chose this over a yo mamma joke, I'm getting wiser it seems)

[–] pticrix@lemmy.ca 6 points 1 day ago (1 children)

May I still get the yo mama joke?

[–] BeatTakeshi@lemmy.world 16 points 1 day ago (1 children)

Yo mamma so fat it's always high tide when she's at the beach

[–] pticrix@lemmy.ca 3 points 19 hours ago (1 children)

Oh yeah? Well yo mama teeth are so yellow, when she smiles the traffic slows down!

[–] BeatTakeshi@lemmy.world 5 points 18 hours ago (1 children)

Oh yeah? Yo mama so stubborn, Waze added a "fine, you drive" instruction

[–] pticrix@lemmy.ca 3 points 13 hours ago (1 children)

Oh yeah? Yo mama so dumb, she left your dad for her ChatGPT-borne boyfriend

[–] BeatTakeshi@lemmy.world 2 points 5 hours ago (1 children)

Oh yeah? Yo mama so nice, I wish she was mine! Wait...

[–] MrChewy@lemmy.world 2 points 4 hours ago

Alright alright, you guys are friends now, by the official unofficial internet rules of random interaction, you may kiss now

[–] not_IO@lemmy.blahaj.zone 88 points 1 day ago (4 children)

for anyone too lazy to click the link: CVE-2026-93829 CVE-2026-93830 CVE-2026-97407 CVE-2026-97408 CVE-2026-97409 CVE-2026-97410 CVE-2026-97411 CVE-2026-97412 CVE-2026-97413 CVE-2026-97414 CVE-2026-97415 CVE-2026-97416 CVE-2026-97417 CVE-2026-97418 CVE-2026-97419 CVE-2026-97420 CVE-2026-97421 CVE-2026-97425 CVE-2026-97427 CVE-2026-97428 CVE-2026-97429 CVE-2026-97430 CVE-2026-97434 CVE-2026-97435 CVE-2026-97436 CVE-2026-97437 CVE-2026-97438 CVE-2026-97439 CVE-2026-97440 CVE-2026-97441 CVE-2026-97442 CVE-2026-97443 CVE-2026-97444 CVE-2026-97445 CVE-2026-97446 CVE-2026-97448 CVE-2026-97449 CVE-2026-97450 CVE-2026-97451 CVE-2026-97452 CVE-2026-97453 CVE-2026-97454 CVE-2026-97455 CVE-2026-97456 CVE-2026-97472 CVE-2026-97473 CVE-2026-97475 CVE-2026-97476 CVE-2026-97481 CVE-2026-97482 CVE-2026-97483 CVE-2026-97484 CVE-2026-97485 CVE-2026-97486 CVE-2026-97487 CVE-2026-97488 CVE-2026-97489 CVE-2026-97490 CVE-2026-97491 CVE-2026-97492 CVE-2026-97494 CVE-2026-97495 CVE-2026-97496 CVE-2026-97497 CVE-2026-97500 CVE-2026-97502 CVE-2026-97504 CVE-2026-97505 CVE-2026-97506 CVE-2026-97507 CVE-2026-97508 CVE-2026-97509 CVE-2026-97510 CVE-2026-97512 CVE-2026-97514 CVE-2026-97516 CVE-2026-97517 CVE-2026-97518 CVE-2026-97520 CVE-2026-97521 CVE-2026-97522 CVE-2026-97523 CVE-2026-97524 CVE-2026-97539 CVE-2026-97540 CVE-2026-97541 CVE-2026-97542 CVE-2026-97543 CVE-2026-97544 CVE-2026-97545 CVE-2026-97546 CVE-2026-97547 CVE-2026-97551 CVE-2026-97552 CVE-2026-97555 CVE-2026-97556 CVE-2026-97557 CVE-2026-97560 CVE-2026-97562 CVE-2026-97564 CVE-2026-97568 CVE-2026-97572 CVE-2026-97573 CVE-2026-97575 CVE-2026-97576 CVE-2026-97577 CVE-2026-97578 CVE-2026-97579 CVE-2026-97581 CVE-2026-97582 CVE-2026-97583 CVE-2026-97584 CVE-2026-97587 CVE-2026-97592 CVE-2026-97595 CVE-2026-97596 CVE-2026-97598 CVE-2026-97599 CVE-2026-97600 CVE-2026-97601 CVE-2026-97602 CVE-2026-97604 CVE-2026-97605 CVE-2026-97606 CVE-2026-97607 CVE-2026-97608 CVE-2026-97611 CVE-2026-97612 CVE-2026-97613 CVE-2026-97616 CVE-2026-97617 CVE-2026-97899 CVE-2026-97900 CVE-2026-97902 CVE-2026-97904 CVE-2026-97905 CVE-2026-97907 CVE-2026-97908 CVE-2026-97909 CVE-2026-97910 CVE-2026-97915 CVE-2026-97916 CVE-2026-97917 CVE-2026-97920 CVE-2026-97921 CVE-2026-97922 CVE-2026-97923 CVE-2026-97924 CVE-2026-97925 CVE-2026-97926 CVE-2026-97927 CVE-2026-97929 CVE-2026-97930 CVE-2026-97931 CVE-2026-97936 CVE-2026-97940 CVE-2026-97945 CVE-2026-97948 CVE-2026-97951 CVE-2026-97952 CVE-2026-97953 CVE-2026-97954 CVE-2026-97957 CVE-2026-97958 CVE-2026-97959 CVE-2026-97961 CVE-2026-97963 CVE-2026-97964 CVE-2026-97965 CVE-2026-97966 CVE-2026-97967 CVE-2026-97968 CVE-2026-97969 CVE-2026-97970 CVE-2026-97973 CVE-2026-97976 CVE-2026-97977 CVE-2026-97978 CVE-2026-97979 CVE-2026-97981 CVE-2026-97982 CVE-2026-97984 CVE-2026-97985 CVE-2026-97986 CVE-2026-97987 CVE-2026-97990 CVE-2026-97991 CVE-2026-97992 CVE-2026-97993 CVE-2026-97994 CVE-2026-97995 CVE-2026-97996 CVE-2026-97998 CVE-2026-98001 CVE-2026-98006 CVE-2026-98007 CVE-2026-98008 CVE-2026-98009 CVE-2026-98010 CVE-2026-98011 CVE-2026-98012 CVE-2026-98013 CVE-2026-98014 CVE-2026-98015 CVE-2026-98016 CVE-2026-98017 CVE-2026-98018 CVE-2026-98020 CVE-2026-98021 CVE-2026-98022 CVE-2026-98023 CVE-2026-98024 CVE-2026-98025 CVE-2026-98026 CVE-2026-98027 CVE-2026-98028 CVE-2026-98029 CVE-2026-98030 CVE-2026-98031 CVE-2026-98037 CVE-2026-98039 CVE-2026-98041 CVE-2026-98045 CVE-2026-98046 CVE-2026-98051 CVE-2026-98052 CVE-2026-98054 CVE-2026-98055 CVE-2026-98056 CVE-2026-98057 CVE-2026-98059 CVE-2026-98063 CVE-2026-98064 CVE-2026-98066 CVE-2026-98068 CVE-2026-98069 CVE-2026-98070 CVE-2026-98071 CVE-2026-98072 CVE-2026-98074 CVE-2026-98075 CVE-2026-98076 CVE-2026-98077 CVE-2026-98078 CVE-2026-98080 CVE-2026-98081 CVE-2026-98082 CVE-2026-98083 CVE-2026-98086 CVE-2026-98088 CVE-2026-98089 CVE-2026-98090 CVE-2026-98091 CVE-2026-98092 CVE-2026-98094 CVE-2026-98095 CVE-2026-98096 CVE-2026-98097 CVE-2026-98098 CVE-2026-98102 CVE-2026-98103 CVE-2026-98104 CVE-2026-98105 CVE-2026-98107 CVE-2026-98108 CVE-2026-98109 CVE-2026-98110 CVE-2026-98111 CVE-2026-98113 CVE-2026-98114 CVE-2026-98116 CVE-2026-98121 CVE-2026-98122 CVE-2026-98123 CVE-2026-98126 CVE-2026-98127 CVE-2026-98128 CVE-2026-98129 CVE-2026-98130 CVE-2026-98142 CVE-2026-98151 CVE-2026-98152 CVE-2026-98154 CVE-2026-98155 CVE-2026-98157 CVE-2026-98158 CVE-2026-98159 CVE-2026-98160 CVE-2026-100070 CVE-2026-100071 CVE-2026-100075 CVE-2026-100078 CVE-2026-100079 Debian Bug : 1108860

[–] adarza@lemmy.ca 3 points 12 hours ago

it also says:

For the stable distribution (trixie), these problems have been fixed in version 6.12.111-1.

[–] rob_t_firefly@lemmy.world 7 points 17 hours ago* (last edited 17 hours ago)

Comic frame cropped from a "Happy Noodle Boy" strip by Jhonen Vasquez. A baby in a stroller says, "Googli-shmoogly. Ga ga pooffft! Goo goo boop. Pooooooh.." Happy Noodle Boy, a crazed stick figure walking by the scene, responds, "Gasp! The fuckin' password!"

[–] mobyduck648@lemmy.world 11 points 1 day ago

That is indeed a great deal of CVEs.

[–] mysticalone@lemmy.world 43 points 1 day ago (1 children)

and if i am too lazy to read?

[–] Sturgist@piefed.ca 90 points 1 day ago (1 children)

TL;DR - Jesus, that's a lot of CVEs.

[–] elvith@feddit.org 22 points 1 day ago (1 children)

Can you translate that for other religions and atheists, too?

[–] SkaveRat@discuss.tchncs.de 42 points 1 day ago

"shit's fucked"

[–] twinnie@feddit.uk 45 points 1 day ago (4 children)

Some of them are 2024 and 2025. How come they made it into this list?

[–] Wispy2891@lemmy.world 32 points 1 day ago* (last edited 1 day ago) (1 children)

Some of them aren't actually bugs but just "security" people wanting to get a longer epenis by flagging issues like "maximum priority, it allows to read the ssh private key!!!1!!" And then the details are like "when typing more ./ssh/id_rsa the user private key is shown, terminal should intercept and block request"

And with LLMs it's even worse as they're directed to find nitpicks at all costs

[–] MrScottyTay@sh.itjust.works 5 points 1 day ago (2 children)

What's an e-penis?

[–] Asfalttikyntaja@sopuli.xyz 20 points 1 day ago (1 children)

Don’t know, but I’m sure mine is bigger than yours.

[–] MrScottyTay@sh.itjust.works 7 points 1 day ago

Haha! Got me! :p

[–] mobyduck648@lemmy.world 11 points 1 day ago (1 children)

An e-penis is to a penis what an e-bike is to a bike.

[–] MrScottyTay@sh.itjust.works 10 points 1 day ago (1 children)

So... you can ride it faster?

[–] Jayjader@jlai.lu 7 points 18 hours ago

Maybe it speeds up when you twist the handle

[–] dgdft@lemmy.world 80 points 1 day ago (1 children)

Serious answer: They’re low priority bullshit rather than practical security concerns.

“This method crashes if you intentionally feed it malformed data!!”- type of stuff.

[–] jj4211@lemmy.world 6 points 12 hours ago

Curl guy has written about a couple of these stupid CVEs, for example: https://daniel.haxx.se/blog/2023/09/05/bogus-cve-follow-ups/

One I recall was that if you asked curl to write out c code example of libcurl usage, you could get it to write out arbitrary code of your choosing. Note that this required you to have write permission and curl and then with your malicious c code, you then had to compile it and make it executable and run it yourself. So a very roundabout way to use curl as a text editor, and they considered it an arbitrary code execution issue, despite not actually executing the code.

[–] queerlilhayseed@piefed.blahaj.zone 17 points 1 day ago

The following is my guess, I don't know what the Debian project's selection criteria for security advisories are.

Taking the first one as an example, CVE-2024-52560 is a bug that affects version 5.15 of the Linux Kernel. The oldest version of Debian that's still in general LTS is Debian 11 which shipped with Linux 5.10. So they are still supporting releases that may be running the affected kernel and can't upgrade the kernel for some reason, but would still benefit from some downstream patches that mitigate the exposure of the kernel bug.

[–] Kazumara@discuss.tchncs.de 2 points 1 day ago

Looking through these I don't really see a big commonality.

Interesting that for some of them only trixie is affected, not bookworm. Maybe that's down to bugs in newer sections of code.

[–] Sanctus@anarchist.nexus 23 points 1 day ago (2 children)

At least they are aware 😰

[–] not_IO@lemmy.blahaj.zone 6 points 1 day ago

[–] TerraRoot@sh.itjust.works 24 points 1 day ago (1 children)

Much worse if there are no CVE's...

[–] Sanctus@anarchist.nexus 9 points 1 day ago

Nothing to see here, citizen. Move along.

[–] ChickenLadyLovesLife@lemmy.world 2 points 1 day ago

Escort carriers?

[–] hexagonwin@lemmy.today 12 points 1 day ago (1 children)

wait why are there 2024 cves?

[–] moth@anarchist.nexus 10 points 1 day ago

moth will answer you tomorrow, assuming moth remembers and finds time, is why

[–] RestrictedAccount@lemmy.world 9 points 1 day ago (3 children)

I saw this in the CISA announcement today. I was wondering if either:

the project to port the kernel to rust Or
people using AI to look for vulnerabilities

Caused the huge list?

(IBM had a ton too)

[–] Miaou@jlai.lu 4 points 23 hours ago

Given 1 isn't true, it's a rather easy guess

[–] Ooops@feddit.org 21 points 1 day ago

More the fact that it's Debian and they still support huge amounts of ancient stuff. There are year's old ones in the list... alas, Debian still supports kernels like 5.10LTS. And backporting fixes doesn't get easier over time.

[–] dgdft@lemmy.world 11 points 1 day ago* (last edited 1 day ago)

It’s the latter; the kernel CVE report counts have gone through the roof in the past few years.

No one is porting the whole kernel to rust (as part of the official project, at least).