Post #3114972

2026-04-30 08:43 UTC

@warthog9@social.afront.org @argv_minus_one@mastodon.sdf.org Heck, this was even one of the very few CVE entries that we actually scored, giving it a 7.8 on the CVSS scale. We rarely score these things, but when we do, perhaps people should actually pay attention? Makes me wonder why we even do this sometimes... {sigh}

Replies (1)

@warthog9@social.afront.org 2026-04-30 15:12

@gregkh@social.kernel.org @argv_minus_one@mastodon.sdf.org won't disagree in the slightest on that front, and I'm not laying my grumbles at the kernel communities feet here. The kernel security team did it's job, there's a fix, no issue there. Where I'm grumbling is it looks like the public disclosure happened before the distros were aware, and in such a way that there was even a chance at a fix out for people to actually update to. While I would love to have folks be able to go, compile their own kernel and get to mainline to pick up the fix, the reality in a lot of deployments means you can't, even in some of the deployments I've got to handle these days we can't just because of other driver mess issues (that's a whole different can of worms worthy of much void screaming, but I'm not going to do that here right now). Debian and Ubuntu look like they have a minor up side they left the code as modules, reject loading the modules and you can steer clear of this right now. EL / Fedora, look like they picked the option to compile it straight in and are kinda up a creek right now. Fedora will likely be sorted quite shortly, but that's because they track mainline a lot closer. EL, only good option there is to flip to elrepo and go mainline there assuming you don't have other messes to deal with. Mostly the grumble is laid at the feet of the finder wanting to publicize it seemingly as quickly as they did, some of the distros for dragging their feet and/or ignoring these things the way they tend to, and for at least not vaguely giving the distros a chance to go "ohhh poop", and have fixes in place once it was public (again that's more laid back at the publicized situation vs. not). Right now there's a lot of scramble for a bunch of folks, and not a lot of ways to get to a fix, and that's where I'm grumbling from (though I haven't had enough coffee / tea yet this morning to go find how far that's moved overnight, so bear with me if they've all miraculously pulled a fast one and everyone has a fix out for everyone)

Open ##3114973