Thread

Several vulnerabilities have been discovered in the Linux kernel

576 points · 408 comments · luispa

drfloyd51 · 1790903371 · focus · HN ↗
Is it possible that some of these bugs were already exploited by governments? And AI might help use close of that kind of thing? (And expose other kinds of things , in a kind of AI arms race?)
1. sippingabonedry · 1790903984 · focus · HN ↗
  Will everyone chill the F out for a minute?
  These get released every few weeks. Tons of CVEs. If a kernel developer farts in the forest, does anyone hear it?
  August saw separate Debian kernel updates released four days apart. Does anyone even reboot that often?
  I have three kernels installed over the last 45 days or so and I probably missed a few.
  1. nightfly · 1790904427 · focus · HN ↗
    I've been doing Linux sys-admin work for 10+ years. Used to be I could read the full report on what ever vulnerabilities came out and triage which servers needed to be updated now and which could wait. A few years ago notifications started having so many it would take more time/effort to read everything than it would to patch everything. With this notification there's even ten times more...
    sippingabonedry · 1790904845 · focus · HN ↗
    The amount of updates on Debian "stable" has become ridiculous, it's a daily rolling release of backports at this point.
    Microsoft kinda got this right by doing it once a month, unless it's something horribly bad, you can plan your maintenance around a predictable calendar.
    vortext · 1790905620 · focus · HN ↗
    You can choose to only install updates that require a restart once a month on Debian, then it's the same.
    Gigachad · 1790908652 · focus · HN ↗
    That's because the methodology changed in 2024
    >Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team are overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team.
    <a href="https://lwn.net/Articles/961961/" rel="nofollow">https://lwn.net/Articles/961961/
  2. SoftTalker · 1790905407 · focus · HN ↗
    We're considering weekly reboots at work now with the pace of kernel updates coming out, and the speed with which vulnerabilities are getting exploited.
    sippingabonedry · 1790905833 · focus · HN ↗
    There is exactly one CVE in the entire list that is high severity, and it affects an obscure IBM NIC driver for big iron systems used in companies with more money than brains.
    You can skip the Xanax this week.
    Gigachad · 1790908762 · focus · HN ↗
    Problem is it takes more effort to read the CVE list and work out if you have one of the drivers impacted loaded than it does to just update the kernel.
    sippingabonedry · 1790910870 · focus · HN ↗
    Sorry but I'm not causing outages and rebooting systems every four days because the people whose job it is to do this can't triage properly. They are actively making other's lives more difficult. There's like 100 CVEs in that list and not a one of them is important to most systems. Even worse, if there was 1/100 it's a needle in a haystack.
    Gigachad · 1790912496 · focus · HN ↗
    If your system goes down to update a kernel then you have a major issue already. This is like manually renewing https certs. When the task is done often enough you just automate it in a painless way.
    sippingabonedry · 1790914708 · focus · HN ↗
    There is more to the real world than running webshit behind VM clusters.
    Real businesses still run legacy file/print services, license daemons, proprietary applications. Some still run on bare metal.
    You need outage windows. You can't just YOLO it and update prod during the day, it's unbelieveably irresponsible.
    anal_reactor · 1790922151 · focus · HN ↗
    Well then, it's a business decision to accept the risks. IMO it makes sense that a percentage of machines would always be offline for maintenance. If you're running bare metal and you cannot afford 10% of your machines being offline at most times, then you're in deep shit if there's even a tiny traffic irregularity, and it's a sign that your management is YOLOing the company. Not uncommon though.
    john_strinlai · 1790913989 · focus · HN ↗
    severity on cve is a crapshoot most of the time, but especially with linux cna. i would not advise relying on them for decision making.
    "We can not assign severity
    [...]
    So any group that attempts to give a “severity score” to a Linux CVE is lying to you, UNLESS they know exactly your use case.
    ALWAYS ignore any attempt that groups such as NIST/NVD that purport to assign things like CVSS scores to a vulnerability. Those numbers are false and give companies a “fake sense of security”."
    <a href="http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignment-process/" rel="nofollow">http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignmen...
    seany · 1790906530 · focus · HN ↗
    Weekly? 12 or 24hr cadence for upgrades isn't that crazy in some places for cluster hosts...
  3. tclancy · 1790907365 · focus · HN ↗
    Regarding the fart question, it depends on the audio driver and the underlying codec. While you would think “free as in beer” would make for truly resonant flatulence, only truly letting loose (plus a Bic lighter) brings real enlightenment.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.