this post was submitted on 23 Oct 2026
84 points (100.0% liked)

Linux

68226 readers
629 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 7 years ago
MODERATORS
 

Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list. The vulnerabilities have yet to be patched on mainline but at least in some cases there are patches undergoing testing or queued in "-next" branches. The CVSS scores are as high as 9.0.

Trend Micro's Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list (LKML) rather than the typical private security mailing list. This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list.

Among these newly-disclosed vulnerabilities include:

ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

The bug and security reports keep on coming in the AI fueled world.

top 13 comments
sorted by: hot top controversial new old
[–] ennof@feddit.org 9 points 2 hours ago

So what are the consequences? No internet for my machine today, I guess?

[–] executivechimp@discuss.tchncs.de 45 points 5 hours ago (1 children)
[–] 1984@lemmy.world 17 points 3 hours ago

Captain, it's Friday.

[–] vas@lemmy.ml 12 points 4 hours ago* (last edited 1 hour ago) (6 children)

This seemingly was a mistake with Linux’s second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list.

I hope that was not AI automation, with him being a lover and a loud public advocate of it.

EDIT: we've misread the text. It wasn't a mistake by Greg, but merely that he was the one to reply. Nobody directed Trend Micro to the public mailing list, they did it by themselves (as far as we know).

[–] TrickDacy@lemmy.world 1 points 41 minutes ago* (last edited 38 minutes ago)

with him being a lover and a loud public advocate of it.

I googled the guy's name and as expected, I found him suggesting ai is good for finding bugs now, unlike in the past. No quotes of him praising its use let alone across the board.

I am generally against AI but what exactly is the point of opposing it to the point of denying it has any use whatsoever, exaggerating anything anyone says remotely in favor of it, or in this case making up harm that AI hypothetically may have caused? Doing things like that is just destroying the credibility of opposing AI, and I see this kind of approach to it constantly on here.

No, Linux is not "vibecoded" now. No, Torvalds is not an AI simp now. Yes, there are some uses of AI that are probably worth the downsides (which anyone can see and should admit to). Binary thinking is not productive.

[–] zip@lemmy.blahaj.zone 9 points 2 hours ago* (last edited 2 hours ago) (2 children)

As other replies to you have touched on, I believe you've misread/misunderstood that, although I understand why. It definitely could've been worded more clearly.

What it means is more along the lines of:

This seemingly was a mistake. Linux’s second-in-command Greg Kroah-Hartman responded to each report asking about their submission to the public mailing list.

He's not the one that submitted them. He's the one that replied to them asking "wtf!?"

[–] juipeltje@lemmy.world 3 points 1 hour ago

Ah that makes sense, i was reading that in the wrong way as well and was wondering how that fuckup would even happen

[–] vas@lemmy.ml 1 points 1 hour ago* (last edited 1 hour ago)

Thank you for the clarification! That makes more sense honestly. Indeed I have read it differently at first.

[–] sonstwas@sh.itjust.works 12 points 2 hours ago (1 children)

What does it have to with Kroah-Hartmans stance on AI when it wasn't him that made the mistake?

This here was the mistake that Kroah-Hartman was questioning:

Trend Micro's Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list (LKML) rather than the typical private security mailing list.

[–] vandsjov@feddit.dk 1 points 23 minutes ago

What does it have to with Kroah-Hartmans stance on AI when it wasn’t him that made the mistake?

Because any mistakes he does is of cause due to some AI glitch, that proves that he is wrong about saying anything positive about AI, and it could never be something else. Well, beside that it wasn't him that posted to the wrong mailing list.

[–] sanzky@lemmy.world 1 points 1 hour ago

why? I really hope it was! so much funnier

[–] MonkderVierte@lemmy.zip 6 points 2 hours ago* (last edited 2 hours ago)

Trend Micro's Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list

You don't read stuff?

[–] SocialistVibes01@lemmy.ml 2 points 3 hours ago* (last edited 3 hours ago)

I'd bet it was. And love has nothing to do with AI in the kernel. He's on the payroll of techbros, of course he'd be an AI advocator.