It's KVM we should really be worried about anyway.
truthfultemporarily 110 points 10 days ago
To add, pretty much any kernel bug gets a CVE because everything wrong in the kernel could theoretically be abused.
truthfultemporarily 25 points 10 days ago
Yes, hence why you would have to check the CVSS of all of those.
AnAmericanPotato 67 points 10 days ago
Most of them are just crashing bugs. Worth fixing but you don't need to panic. If anyone exploits them, then A) you'll know about it, and B) they won't get away with anything sensitive.
bobtimus_prime 75 points 10 days ago
No need to panic? Tell that the kernel! :D
SeductiveTortoise 6 points 10 days ago
The kernel is really anxious though, panics all the time.
carrylex 92 points 10 days ago
Hmm yes "vulnerabilities".
My personal highlight: https://nvd.nist.gov/vuln/detail/cve-2026-43073
Rename misleadingly named '__copy_user_nocache()' function. This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally neither of those things.
Credits: https://lemmy.world/comment/26110292
spicehoarder 4 points 9 days ago
Maybe it's vulnerable as in admitting to being stupid? /s
username_1 41 points 10 days ago
1,313
Less than one and a half? Not a big deal.
luciferofastora 26 points 10 days ago
Pretty sure the person you responded to knows that and is joking, since you can hardly have a fraction of a CVE. Germany (where their instance is hosted) uses comma for decimal separators, so that joke is pretty close at hand.
username_1 14 points 10 days ago
Actually I am sure otherwise. I believe comma is more widespread per country (dot might be more widespread by populace due to China, though)
cypherpunks 12 points 10 days ago
I believe comma is more widespread per country
it looks like you might be right... I'm surprised to learn that https://en.wikipedia.org/... lists 83 countries who use comma as decimal separator, and only 59 who use dot (and presumably the thousands separator is usually the opposite of the decimal separator). However there are enough countries which aren't on either list that it isn't entirely clear from that page which convention is actually used in more countries.
Also, it's much more complicated than the . vs , binary... among other oddities:
- Historically, in Germany and Austria, thousands separators were occasionally denoted by alternating uses of commas and points, e.g. "1.234,567.890,12" (or "1.234,567.890Β·12" in Austria-Hungary and Austria prior to 1938) for "eine Milliarde 234 Millionen ...", but this is not seen today and contemporary German readers would require an explanation to understand it.
- In Switzerland, there are two styles. Currency values use an apostrophe (
') as a thousands separator along with a dot (.) as the decimal separator, like "1'234'567.89". For other values, the SI-style "1 234 567,89" is used, with a comma (,) as the decimal separator. The apostrophe is also the most common thousands separator for non-currency values, like "1'234'567,89".
Damage 7 points 10 days ago
Here in Italy the thousands separator used to be a "high dot", like the apostrophe you mention but in the shape of a dot... But our keyboards have no easy way to output that symbol so it went out of fashion over the last 20-30 years.
festnt 2 points 9 days ago
interesting. in brazil we use . for thousands and , for decimals, and most of my knowledge from outside is english-speaking countries (mostly the US), so i guess i just thought that was the default
kSPvhmTOlwvMd7Y7E 2 points 9 days ago
I hate commas used as thousands separators, with passion
possiblylinux127 27 points 10 days ago
All bugs are treated as CVEs
cypherpunks 27 points 10 days ago
Debian problems I guess
Not really; the Linux kernel has had 8500 CVEs so far this year (according to this).
Most of them aren't actually known to be definitely-exploitable security bugs, but some are. You can read more about how Linux issues CVEs from this post on Greg Kroah-Hartman's website: Linux CVEs, more than you ever wanted to know (and/or watch one of his talks on the subject which is linked from there).
See also this article from July: Linux kernel team publishes 432 CVEs in two days: Sunday-to-Monday onslaught fuels speculation over AI-assisted bug reports.
Buddahriffic 3 points 10 days ago
Yeah, just to add some context, you can detect potential buffer overruns in code by looking for patterns but just because you find potential buffer overruns doesn't mean they are exploitable. The user needs to be able to inject not just code or parameters but also a return address that causes the injected code to run or triggers another function call with the injected parameters. With randomized code and stack addresses, this can be difficult or practically impossible, even if it's easy to customize what bytes go into the overrun part of the buffer.
It's like finding small parts of dangerous patterns but those small parts aren't necessarily dangerous on their own and need more of the pattern to be an issue, but if you fix the small parts you find, you're less likely run into those bigger patterns, so it's worthwhile to fix the small patterns when they come up, but without fitting into a larger pattern, it wasn't an actual security hole, just a potential one.
cypherpunks 10 points 10 days ago
But still listing yearβs old vulnerabilities that got fixed long ago because they are still supporting ancient stuff like 5.10LTS is Debian-specific.
The advisory this meme is about only relates to the 6.12 kernel in Debian 13 "trixie" (Debian's current stable release), and 1,295 of these 1,313 CVEs are from 2026.
Linux 6.12 is the SLTS ("super long-term support") release from 2024, so the Linux Foundation's Civil Infrastructure Platform plans to continue backporting security fixes to it until 2035.
Debian stopped supporting Debian 11 "bullseye" (the one with a 5.10 kernel) in August, but that kernel is also an SLTS which CIP plans to support until 2031.
So, no, continuing support for these kernels is not something Debian-specific.
Here are the versions of linux-image-amd64 in Debian currently:
bullseye (oldoldstable) (kernel): Linux for 64-bit PCs (meta-package)
5.10.262-1 [security]: amd64
bookworm (oldstable) (kernel): Linux for 64-bit PCs (meta-package)
6.1.187-1 [security]: amd64
bookworm-backports (kernel): Linux for 64-bit PCs (meta-package)
6.12.95-1~bpo12+1: amd64
trixie (stable) (kernel): Linux for 64-bit PCs (meta-package)
6.12.111-1 [security]: amd64
trixie-backports (kernel): Linux for 64-bit PCs (meta-package)
7.1.13-1~bpo13+1: amd64
forky (testing) (kernel): Linux for 64-bit PCs (meta-package)
7.2.8-1: amd64
sid (unstable) (kernel): Linux for 64-bit PCs (meta-package)
7.2.8-1: amd64
DonutsRMeh 7 points 10 days ago
All with AI
cypherpunks 4 points 10 days ago
Yes, probably not all but certainly most bugs being found now are.
DonutsRMeh 3 points 10 days ago
Most of them, yes.
kurmudgeon 5 points 10 days ago
If the PS5 is based off of Linux, and some of these vulnerabilities tested, don't impact the PS5 in any way, does that mean technically Sony could get sued for not recontributing code back to the Linux projects? I mean, it means they fixed the issues on the PS5 but didn't contribute it back right?
CaptainBasculin 40 points 10 days ago
I'm pretty sure PS5 is based off of BSD, whose license pretty much translates in corporate world to do whatever the fuck you want with it.
kurmudgeon 3 points 10 days ago
You're right, this does seem to be the case. Good to know.
cypherpunks 16 points 10 days ago
If the PS5 is based off of Linux
I don't think it is though? After a few seconds searching I don't see anything conclusive but PS4's OS was based on FreeBSD so I would guess PS5's probably is also. (I see that if you have a PS5 with old enough firmware you can put Linux on it yourself...)
Sony does have some experience shipping Linux-based products though (probably first with Linux for PS2 in 2002, and more recently various android devices) and surely knows how to comply with the GPL.
kurmudgeon 4 points 10 days ago
Ah, you're right. It is BSD. Good to know. I was simply posing a hypothetical though, I always wondered about things like this
carrylex 5 points 10 days ago
vulnerabilities tested, don't impact the PS5 in any way, does that mean technically Sony could get sued for not recontributing code back to the Linux projects?
No.
Let's assume someone ships the Linux kernel in a device and the kernel has a vulnerability in some obscure subsystem (e.g. AFS) that is never used by the device. The device will not be affected by this vulnerability because the code can't be reached.
StabbingSky 1 point 10 days ago
No, there's no legal requirement to contribute to projects you've used and modified, unless the license explicitly states so.
linuxmemes
@lemmy.world
33061
2389
6292
Hint: :q!
Sister communities:
Community rules (click to expand)
1. Follow the site-wide rules
- Instance-wide TOS: https://legal.lemmy.world/tos/
- Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html
2. Be civil
- Understand the difference between a joke and an insult.
- Do not harrass or attack users for any reason. This includes using blanket terms, like "every user of thing".
- Don't get baited into back-and-forth insults. We are not animals.
- Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
- Bigotry of any kind will not be tolerated. This is an LGBTQ+-friendly community -- if that is a problem for you, you should leave.
3. Post Linux-related content
- Including Unix and BSD.
- Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of
sudoin Windows. - No porn, no politics, no trolling or ragebaiting.
- Don't come looking for advice, this is not the right community.
4. No recent reposts
- Everybody uses Arch btw, can't quit Vim, <loves / tolerates / hates> systemd, and wants to interject for a moment. You can stop now.
5. π¬π§ Language/ΡΠ·ΡΠΊ/Sprache
- This is primarily an English-speaking community. π¬π§π¦πΊπΊπΈ
- Comments written in other languages are allowed.
- The substance of a post should be comprehensible for people who only speak English.
- Titles and post bodies written in other languages will be allowed, but only as long as the above rule is observed.
6. (NEW!) Regarding public figures
We all have our opinions, and certain public figures can be divisive. Keep in mind that this is a community for memes and light-hearted fun, not for airing grievances or leveling accusations.
- Keep discussions polite and free of disparagement.
- We are never in possession of all of the facts. Defamatory comments will not be tolerated.
- Discussions that get too heated will be locked and offending comments removed.
Β
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't remove France.
go to feed...
linuxmemes
@lemmy.world
33061
2389
6292
Hint: :q!
Sister communities:
Community rules (click to expand)
1. Follow the site-wide rules
- Instance-wide TOS: https://legal.lemmy.world/tos/
- Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html
2. Be civil
- Understand the difference between a joke and an insult.
- Do not harrass or attack users for any reason. This includes using blanket terms, like "every user of thing".
- Don't get baited into back-and-forth insults. We are not animals.
- Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
- Bigotry of any kind will not be tolerated. This is an LGBTQ+-friendly community -- if that is a problem for you, you should leave.
3. Post Linux-related content
- Including Unix and BSD.
- Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of
sudoin Windows. - No porn, no politics, no trolling or ragebaiting.
- Don't come looking for advice, this is not the right community.
4. No recent reposts
- Everybody uses Arch btw, can't quit Vim, <loves / tolerates / hates> systemd, and wants to interject for a moment. You can stop now.
5. π¬π§ Language/ΡΠ·ΡΠΊ/Sprache
- This is primarily an English-speaking community. π¬π§π¦πΊπΊπΈ
- Comments written in other languages are allowed.
- The substance of a post should be comprehensible for people who only speak English.
- Titles and post bodies written in other languages will be allowed, but only as long as the above rule is observed.
6. (NEW!) Regarding public figures
We all have our opinions, and certain public figures can be divisive. Keep in mind that this is a community for memes and light-hearted fun, not for airing grievances or leveling accusations.
- Keep discussions polite and free of disparagement.
- We are never in possession of all of the facts. Defamatory comments will not be tolerated.
- Discussions that get too heated will be locked and offending comments removed.
Β
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't remove France.
go to feed...
Honestly, great! More bugs found, more bugs fixed, better system for everyone.
save