Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 23 Dec 2022 15:20:17 +0100
From: Greg KH <>
Subject: Re: Details on this supposed Linux Kernel ksmbd RCE

On Fri, Dec 23, 2022 at 09:04:25AM -0500, Sasha Levin wrote:
> On Fri, Dec 23, 2022 at 09:17:28AM +0100, Marcus Meissner wrote:
> > Not sure why they do not like you, but to be very clear anyone else can
> > requests CVEs for the kernel, (except the blacklisted drivers/staging/ area).
> For CVEs assigned (earlier this month) to issues in drivers/staging,
> what would be the process to remove the assignment or mark them as
> invalid?

And who is doing this "blacklisting" of staging drivers from CVEs?  Why
are they special when many distros do enable and rely on them?

In my talks with MITRE, they have said they don't want to make public
statments about the CVE issues and Linux, which is sad, but they never
mentioned anything about "we will ignore this portion of the kernel
source tree".  Is that in a public statement anywhere that I can point
to when people ask the kernel security team for CVEs?


greg k-h

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.