[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2026050453-gamma-stuffing-8606@gregkh>
Date: Mon, 4 May 2026 08:58:47 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Sam James <sam@...too.org>
Cc: oss-security@...ts.openwall.com, Taeyang Lee <0wn@...ori.io>,
Brad Spengler <spender@...ecurity.net>,
Solar Designer <solar@...nwall.com>
Subject: Re: Precise disclosure contents for copyfail (Re:
CVE-2026-31431: CopyFail: linux local privilege scalation)
On Sun, May 03, 2026 at 10:53:10PM +0100, Sam James wrote:
> Per Greg's comments [1]:
> >> The scoring reasoning for this CVE does not hint at its severity and the
> >> threat being imminent. It's as obscure as most of the rest of 168 are
> >> (which for most of them is probably a result of actually not having
> >> exploitability and impact analysis).
> > Why do you think that we knew this was "imminent"? The CVE team has no
> > such knowlege as no one is obligated to tell us that they are about to
> > let loose a trivial exploit.
>
> Is the CVE team not aware of public mailing list postings?
No.
> Perhaps
> including full links and context in commit messages would help them not
> lose track?
Perhaps, but again, consider the volume of what we work with.
> If the CVE team were unable to do this, then it absolutely
> would have helped distributions. I often chase links given in commit
> messages?
>
> Is the kernel honestly proud of how this went?
Exactly what do you suggest that we do "better" here and how to do that?
The kernel security team gets "this is a local user increase in
permission" bug reports all the time. Why this specific one is somehow
more "special" than others was not obvious except after the fact because
the submitter decided to provide their exploit code to the world to show
off their tool. That is something that normally does not happen and is
outside of the control of all of us involved here.
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
