2026-09-29 12:43 UTC
@fionescu@mastodon.bsd.cafe @peteorrall@mastodon.bsd.cafe @stefano@mastodon.bsd.cafe This is (unfortunately?) due to the Linux kernel developers’ stance of classifying many/most bugs as potential security issues once they became their own CVE numbering authority (CNA). For that process difference alone, it’s a bit hard to compare, even if I’m sure they have been discovering issues much more rapidly over the past year.
https://utcc.utoronto.ca/~cks/space/blog/linux/KernelBugfixCVEsAStory
Replies (1)
-
@adx@infosec.exchange 2026-09-29 12:49
@matt_garber@mastodon.social @fionescu@mastodon.bsd.cafe @peteorrall@mastodon.bsd.cafe @stefano@mastodon.bsd.cafe I have to give Greg some credit though. The CVE system has led to a lot of check box compliance and a lot of people running to the -stable list to complain about externally allocated CVEs not being checkboxable. He decided that if you want some boxes to check and here are some boxes to check. It's malicious compliance at it's finest.