Post #935211

2026-03-30 06:49 UTC

We&#39;ve gotten five different &quot;security reports&quot; about the decades old USBIP protocol https://docs.kernel.org/usb/usbip_protocol.html and how it is &quot;insecure&quot; in the past few days. Yes, it&#39;s only to be run between &quot;trusted&quot; devices, and we will gladly take patches so see the ones recently posted to the linux-usb mailing list to mitigate these issues, but this is very strange as to why all of a sudden this is being reported all at the same time by random different semi-anonymous accounts. Is there some big usb-over-ip installation somewhere that people suddenly started caring about out there, or did some internal hacking tool that uses usbip just get leaked? No one who we asked &quot;why?&quot; when they submitting these issues would give a very clear answer to that simple question so something is going on...

Replies (8)

@TheStroyer@mastodon.social 2026-03-30 06:54

@gregkh could it be LLM's discovering the 'security vulnerability' and not understanding the threat model? Not sure why there would be 5 at the same time though

Open ##935214
@aho@mastodon.social 2026-03-30 06:58

@gregkh someone used LLM to generate them?

Open ##935215
@never_released@mastodon.social 2026-03-30 07:12

@gregkh > Is there some big usb-over-ip installation somewhere Probably not that security sensitive because on the same machine but WSL2 https://learn.microsoft.com/en-us/windows/wsl/connect-usb

Open ##935216
@lkundrak@metalhead.club 2026-03-30 07:36

@gregkh there is a small installation of two computers at my home that works well since this was out-of-tree

Open ##935217
@ffmancera@mastodon.social 2026-03-30 07:51

@gregkh a pattern I have seen recently is new people on kernel reporting bugs on random subsystems. I am pretty sure they just feed the code to a LLM and send whatever it found. E.g yesterday I got a review on a patch I sent a year ago on protocol that is pretty uncommon. After talking to the reviewer, it is clearly an AI. It is by the way, the same person that sent a 22 patches series for rtl8723bs that you needed to review :/

Open ##935218
@atjn@mastodon.online 2026-03-30 07:58

@gregkh My guess is someone made a novel prompt that made their LLM focus specifically on the USBIP protocol. It found and reported a minor issue. Now all other LLMs have the original report in their model, so they naturally focus on the USBIP protocol when presented with generic prompts, such as "find a vuln in the kernel", and now that effect is snowballing.

Open ##935219
@9lore@donotsta.re 2026-03-30 10:49

@gregkh Maybe vulns used by commercial law enforcement malware like cellbrite?

Open ##935220
@gregkh@social.kernel.org 2026-04-01 09:22

Ok, it's now 6, something is odd is happening...

Open ##935221