https://lists.debian.org/debian-security-announce/2026/msg00441.html

carrylex 94 points 13 days ago

Are these real vulnerabilities or are these "When Mars and Jupiter are aligned next to each other and you compile the kernel backwards X might crash" ones?

save

path: 0 26081437, hotness: undefined, score: 94, children: 17

BeatTakeshi 56 points 13 days ago

Like the tide, only the moon affects kernel compilation

save

path: 0 26081437 26081904, hotness: undefined, score: 56, children: 10

pticrix 26 points 12 days ago

Hate to break it to you, but the sun also affects tides.

Tap for spoiler

save

path: 0 26081437 26081904 26084327, hotness: undefined, score: 26, children: 9

BeatTakeshi 13 points 12 days ago

Gravity equation says everything with a mass does... Compiling Gentoo removes the sun from the equation anyway (I chose this over a yo mamma joke, I'm getting wiser it seems)

save

path: 0 26081437 26081904 26084327 26087525, hotness: undefined, score: 13, children: 8

pticrix 6 points 12 days ago

May I still get the yo mama joke?

save

path: 0 26081437 26081904 26084327 26087525 26087764, hotness: undefined, score: 6, children: 7

droans 17 points 11 days ago

We use Copilot to review PRs at work. It loves these kinds of scenarios.

The other day, I was adjusting a drop-down site filter to only show options that would work for the given user. It threw up a "critical vulnerability alert" complaining that I "validated" the user's selection based on all options, not just the ones they can view.

First off, it wasn't validation. It was me getting the value of the option. Second, they literally couldn't do anything if they did select one of those options. And third, the user could bypass it about a dozen other ways, even if I designed it to be a validator.

save

path: 0 26081437 26103339, hotness: undefined, score: 17, children: 0

jj4211 12 points 11 days ago

Yeah, CVEs are usually nothing when you get down to understanding, especially kernel CVEs, which almost always declares a CVE for almost any bug, because it is easier that trying to think if it is a security issue or not and basically just assume it could be.

Huge pain as in my work we have a security policy where any unpatched CVEs that cannot be updated away must have a fairly significant writeup delving into the nuance of the CVE and what mitigation has been applied or a rationalization of why it isn't a risk and by policy we have to second guess every CVE assessment from our vendor, who we explicitly pay to triage and fix this stuff so we don't have to... They used to at least allow us a pass on "low severity" (that's still pretty flawed), but they decided that didn't sound "tough" enough and now every single one must have an answer. So every month a few people have to spend a few days just reading tons of CVEs that are not yet (and frequently never will be) patched by vendor and rationalize it away for the security team. Sometimes the security team will get odd and demand we build our own from upstream (most recently, vim of all things we were mandated to build from source).

save

path: 0 26081437 26102542, hotness: undefined, score: 12, children: 1

apftwb 6 points 11 days ago

I'm so sorry. I hope the pay is good.

save

path: 0 26081437 26102542 26103761, hotness: undefined, score: 6, children: 0

Feathercrown 11 points 11 days ago

142 critical vulnerabilities

checks inside

denial of service only

save

path: 0 26081437 26103264, hotness: undefined, score: 11, children: 2

jj4211 9 points 11 days ago

Probably not even that.

For example: https://nvd.nist.gov/vuln/detail/cve-2026-43073

The short of it is they declared the name of a function to be a vulnerability, because some developers were confused by the name and used it when they shouldn't.

A fine critique of things, but the CVE is considered closed by merely renaming the function, and downstream misuses were considered separate issues.

A "vulnerability" fixed by:

-SYM_FUNC_START(__copy_user_nocache)
+SYM_FUNC_START(copy_to_nontemporal)

save

path: 0 26081437 26103264 26110292, hotness: undefined, score: 9, children: 1

Feathercrown 6 points 11 days ago

lmao that's crazy

I usually encounter it in NPM packages, it's always like "200 critical vulns in your dependencies!" and then 199 of them are "if you pass a regex bomb it takes a long time lol"

save

path: 0 26081437 26103264 26110292 26117536, hotness: undefined, score: 6, children: 0

not_IO 91 points 13 days ago

for anyone too lazy to click the link: CVE-2026-93829 CVE-2026-93830 CVE-2026-97407 CVE-2026-97408 CVE-2026-97409 CVE-2026-97410 CVE-2026-97411 CVE-2026-97412 CVE-2026-97413 CVE-2026-97414 CVE-2026-97415 CVE-2026-97416 CVE-2026-97417 CVE-2026-97418 CVE-2026-97419 CVE-2026-97420 CVE-2026-97421 CVE-2026-97425 CVE-2026-97427 CVE-2026-97428 CVE-2026-97429 CVE-2026-97430 CVE-2026-97434 CVE-2026-97435 CVE-2026-97436 CVE-2026-97437 CVE-2026-97438 CVE-2026-97439 CVE-2026-97440 CVE-2026-97441 CVE-2026-97442 CVE-2026-97443 CVE-2026-97444 CVE-2026-97445 CVE-2026-97446 CVE-2026-97448 CVE-2026-97449 CVE-2026-97450 CVE-2026-97451 CVE-2026-97452 CVE-2026-97453 CVE-2026-97454 CVE-2026-97455 CVE-2026-97456 CVE-2026-97472 CVE-2026-97473 CVE-2026-97475 CVE-2026-97476 CVE-2026-97481 CVE-2026-97482 CVE-2026-97483 CVE-2026-97484 CVE-2026-97485 CVE-2026-97486 CVE-2026-97487 CVE-2026-97488 CVE-2026-97489 CVE-2026-97490 CVE-2026-97491 CVE-2026-97492 CVE-2026-97494 CVE-2026-97495 CVE-2026-97496 CVE-2026-97497 CVE-2026-97500 CVE-2026-97502 CVE-2026-97504 CVE-2026-97505 CVE-2026-97506 CVE-2026-97507 CVE-2026-97508 CVE-2026-97509 CVE-2026-97510 CVE-2026-97512 CVE-2026-97514 CVE-2026-97516 CVE-2026-97517 CVE-2026-97518 CVE-2026-97520 CVE-2026-97521 CVE-2026-97522 CVE-2026-97523 CVE-2026-97524 CVE-2026-97539 CVE-2026-97540 CVE-2026-97541 CVE-2026-97542 CVE-2026-97543 CVE-2026-97544 CVE-2026-97545 CVE-2026-97546 CVE-2026-97547 CVE-2026-97551 CVE-2026-97552 CVE-2026-97555 CVE-2026-97556 CVE-2026-97557 CVE-2026-97560 CVE-2026-97562 CVE-2026-97564 CVE-2026-97568 CVE-2026-97572 CVE-2026-97573 CVE-2026-97575 CVE-2026-97576 CVE-2026-97577 CVE-2026-97578 CVE-2026-97579 CVE-2026-97581 CVE-2026-97582 CVE-2026-97583 CVE-2026-97584 CVE-2026-97587 CVE-2026-97592 CVE-2026-97595 CVE-2026-97596 CVE-2026-97598 CVE-2026-97599 CVE-2026-97600 CVE-2026-97601 CVE-2026-97602 CVE-2026-97604 CVE-2026-97605 CVE-2026-97606 CVE-2026-97607 CVE-2026-97608 CVE-2026-97611 CVE-2026-97612 CVE-2026-97613 CVE-2026-97616 CVE-2026-97617 CVE-2026-97899 CVE-2026-97900 CVE-2026-97902 CVE-2026-97904 CVE-2026-97905 CVE-2026-97907 CVE-2026-97908 CVE-2026-97909 CVE-2026-97910 CVE-2026-97915 CVE-2026-97916 CVE-2026-97917 CVE-2026-97920 CVE-2026-97921 CVE-2026-97922 CVE-2026-97923 CVE-2026-97924 CVE-2026-97925 CVE-2026-97926 CVE-2026-97927 CVE-2026-97929 CVE-2026-97930 CVE-2026-97931 CVE-2026-97936 CVE-2026-97940 CVE-2026-97945 CVE-2026-97948 CVE-2026-97951 CVE-2026-97952 CVE-2026-97953 CVE-2026-97954 CVE-2026-97957 CVE-2026-97958 CVE-2026-97959 CVE-2026-97961 CVE-2026-97963 CVE-2026-97964 CVE-2026-97965 CVE-2026-97966 CVE-2026-97967 CVE-2026-97968 CVE-2026-97969 CVE-2026-97970 CVE-2026-97973 CVE-2026-97976 CVE-2026-97977 CVE-2026-97978 CVE-2026-97979 CVE-2026-97981 CVE-2026-97982 CVE-2026-97984 CVE-2026-97985 CVE-2026-97986 CVE-2026-97987 CVE-2026-97990 CVE-2026-97991 CVE-2026-97992 CVE-2026-97993 CVE-2026-97994 CVE-2026-97995 CVE-2026-97996 CVE-2026-97998 CVE-2026-98001 CVE-2026-98006 CVE-2026-98007 CVE-2026-98008 CVE-2026-98009 CVE-2026-98010 CVE-2026-98011 CVE-2026-98012 CVE-2026-98013 CVE-2026-98014 CVE-2026-98015 CVE-2026-98016 CVE-2026-98017 CVE-2026-98018 CVE-2026-98020 CVE-2026-98021 CVE-2026-98022 CVE-2026-98023 CVE-2026-98024 CVE-2026-98025 CVE-2026-98026 CVE-2026-98027 CVE-2026-98028 CVE-2026-98029 CVE-2026-98030 CVE-2026-98031 CVE-2026-98037 CVE-2026-98039 CVE-2026-98041 CVE-2026-98045 CVE-2026-98046 CVE-2026-98051 CVE-2026-98052 CVE-2026-98054 CVE-2026-98055 CVE-2026-98056 CVE-2026-98057 CVE-2026-98059 CVE-2026-98063 CVE-2026-98064 CVE-2026-98066 CVE-2026-98068 CVE-2026-98069 CVE-2026-98070 CVE-2026-98071 CVE-2026-98072 CVE-2026-98074 CVE-2026-98075 CVE-2026-98076 CVE-2026-98077 CVE-2026-98078 CVE-2026-98080 CVE-2026-98081 CVE-2026-98082 CVE-2026-98083 CVE-2026-98086 CVE-2026-98088 CVE-2026-98089 CVE-2026-98090 CVE-2026-98091 CVE-2026-98092 CVE-2026-98094 CVE-2026-98095 CVE-2026-98096 CVE-2026-98097 CVE-2026-98098 CVE-2026-98102 CVE-2026-98103 CVE-2026-98104 CVE-2026-98105 CVE-2026-98107 CVE-2026-98108 CVE-2026-98109 CVE-2026-98110 CVE-2026-98111 CVE-2026-98113 CVE-2026-98114 CVE-2026-98116 CVE-2026-98121 CVE-2026-98122 CVE-2026-98123 CVE-2026-98126 CVE-2026-98127 CVE-2026-98128 CVE-2026-98129 CVE-2026-98130 CVE-2026-98142 CVE-2026-98151 CVE-2026-98152 CVE-2026-98154 CVE-2026-98155 CVE-2026-98157 CVE-2026-98158 CVE-2026-98159 CVE-2026-98160 CVE-2026-100070 CVE-2026-100071 CVE-2026-100075 CVE-2026-100078 CVE-2026-100079 Debian Bug : 1108860

save

path: 0 26078113, hotness: undefined, score: 91, children: 7

mysticalone 45 points 13 days ago

and if i am too lazy to read?

save

path: 0 26078113 26079094, hotness: undefined, score: 45, children: 3

Sturgist 95 points 13 days ago

TL;DR - Jesus, that's a lot of CVEs.

save

path: 0 26078113 26079094 26080943, hotness: undefined, score: 95, children: 2

elvith 22 points 13 days ago

Can you translate that for other religions and atheists, too?

save

path: 0 26078113 26079094 26080943 26081473, hotness: undefined, score: 22, children: 1

SkaveRat 45 points 13 days ago

"shit's fucked"

save

path: 0 26078113 26079094 26080943 26081473 26081538, hotness: undefined, score: 45, children: 0

mobyduck648 14 points 12 days ago

That is indeed a great deal of CVEs.

save

path: 0 26078113 26089639, hotness: undefined, score: 14, children: 0

rob_t_firefly 8 points 12 days ago

Comic frame cropped from a "Happy Noodle Boy" strip by Jhonen Vasquez. A baby in a stroller says, "Googli-shmoogly. Ga ga pooffft! Goo goo boop. Pooooooh.." Happy Noodle Boy, a crazed stick figure walking by the scene, responds, "Gasp! The fuckin' password!"

save

path: 0 26078113 26097779, hotness: undefined, score: 8, children: 0

adarza 3 points 12 days ago

it also says:

For the stable distribution (trixie), these problems have been fixed in version 6.12.111-1.

save

path: 0 26078113 26102031, hotness: undefined, score: 3, children: 0

twinnie 45 points 13 days ago

Some of them are 2024 and 2025. How come they made it into this list?

save

path: 0 26078187, hotness: undefined, score: 45, children: 11

dgdft 82 points 13 days ago

Serious answer: They’re low priority bullshit rather than practical security concerns.

“This method crashes if you intentionally feed it malformed data!!”- type of stuff.

save

path: 0 26078187 26079651, hotness: undefined, score: 82, children: 1

jj4211 9 points 11 days ago

Curl guy has written about a couple of these stupid CVEs, for example: https://daniel.haxx.se/...

One I recall was that if you asked curl to write out c code example of libcurl usage, you could get it to write out arbitrary code of your choosing. Note that this required you to have write permission and curl and then with your malicious c code, you then had to compile it and make it executable and run it yourself. So a very roundabout way to use curl as a text editor, and they considered it an arbitrary code execution issue, despite not actually executing the code.

save

path: 0 26078187 26079651 26102619, hotness: undefined, score: 9, children: 0

Wispy2891 34 points 12 days ago

Some of them aren't actually bugs but just "security" people wanting to get a longer epenis by flagging issues like "maximum priority, it allows to read the ssh private key!!!1!!" And then the details are like "when typing more ./ssh/id_rsa the user private key is shown, terminal should intercept and block request"

And with LLMs it's even worse as they're directed to find nitpicks at all costs

save

path: 0 26078187 26087645, hotness: undefined, score: 34, children: 6

MrScottyTay 5 points 12 days ago

What's an e-penis?

save

path: 0 26078187 26087645 26087711, hotness: undefined, score: 5, children: 5

Asfalttikyntaja 22 points 12 days ago

Don’t know, but I’m sure mine is bigger than yours.

save

path: 0 26078187 26087645 26087711 26088057, hotness: undefined, score: 22, children: 1

MrScottyTay 7 points 12 days ago

Haha! Got me! :p

save

path: 0 26078187 26087645 26087711 26088057 26088090, hotness: undefined, score: 7, children: 0

mobyduck648 11 points 12 days ago

An e-penis is to a penis what an e-bike is to a bike.

save

path: 0 26078187 26087645 26087711 26089647, hotness: undefined, score: 11, children: 2

MrScottyTay 10 points 12 days ago

So... you can ride it faster?

save

path: 0 26078187 26087645 26087711 26089647 26091040, hotness: undefined, score: 10, children: 1

queerlilhayseed 17 points 13 days ago

The following is my guess, I don't know what the Debian project's selection criteria for security advisories are.

Taking the first one as an example, CVE-2024-52560 is a bug that affects version 5.15 of the Linux Kernel. The oldest version of Debian that's still in general LTS is Debian 11 which shipped with Linux 5.10. So they are still supporting releases that may be running the affected kernel and can't upgrade the kernel for some reason, but would still benefit from some downstream patches that mitigate the exposure of the kernel bug.

save

path: 0 26078187 26079009, hotness: undefined, score: 17, children: 0

Kazumara 2 points 12 days ago

Looking through these I don't really see a big commonality.

Interesting that for some of them only trixie is affected, not bookworm. Maybe that's down to bugs in newer sections of code.

save

path: 0 26078187 26088280, hotness: undefined, score: 2, children: 0

Sanctus 23 points 13 days ago

At least they are aware 😰

save

path: 0 26077978, hotness: undefined, score: 23, children: 3

TerraRoot 25 points 13 days ago

Much worse if there are no CVE's...

save

path: 0 26077978 26078598, hotness: undefined, score: 25, children: 1

Sanctus 9 points 13 days ago

Nothing to see here, citizen. Move along.

save

path: 0 26077978 26078598 26078694, hotness: undefined, score: 9, children: 0

not_IO 6 points 12 days ago

save

path: 0 26077978 26086410, hotness: undefined, score: 6, children: 0

rickdg 14 points 12 days ago

From the image, I thought this was an omarchy meme.

save

path: 0 26088544, hotness: undefined, score: 14, children: 1

someone 4 points 11 days ago

Can we please stop making fun of omsloppy already?

save

path: 0 26088544 26103353, hotness: undefined, score: 4, children: 0

hexagonwin 12 points 13 days ago

wait why are there 2024 cves?

save

path: 0 26078138, hotness: undefined, score: 12, children: 1

moth 11 points 13 days ago

moth will answer you tomorrow, assuming moth remembers and finds time, is why

save

path: 0 26078138 26081306, hotness: undefined, score: 11, children: 0

RestrictedAccount 9 points 13 days ago

I saw this in the CISA announcement today. I was wondering if either:

the project to port the kernel to rust Or
people using AI to look for vulnerabilities

Caused the huge list?

(IBM had a ton too)

save

path: 0 26078475, hotness: undefined, score: 9, children: 3

Ooops 22 points 13 days ago

More the fact that it's Debian and they still support huge amounts of ancient stuff. There are year's old ones in the list... alas, Debian still supports kernels like 5.10LTS. And backporting fixes doesn't get easier over time.

save

path: 0 26078475 26080022, hotness: undefined, score: 22, children: 0

dgdft 11 points 13 days ago

It’s the latter; the kernel CVE report counts have gone through the roof in the past few years.

No one is porting the whole kernel to rust (as part of the official project, at least).

save

path: 0 26078475 26079701, hotness: undefined, score: 11, children: 0

Miaou 4 points 12 days ago

Given 1 isn't true, it's a rather easy guess

save

path: 0 26078475 26091911, hotness: undefined, score: 4, children: 0

sem 9 points 11 days ago

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

For the stable distribution (trixie), these problems have been fixed in
version 6.12.111-1.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/linux

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

save

path: 0 26102434, hotness: undefined, score: 9, children: 0

ChickenLadyLovesLife 3 points 12 days ago

Escort carriers?

save

path: 0 26089378, hotness: undefined, score: 3, children: 0

Impractical_Island -2 points 11 days ago

Will someone touch me? I'll touch you in return. I am not lost.

save

path: 0 26103882, hotness: undefined, score: -2, children: 0