19
The most severe Linux threat to surface in years catches the world flat-footed (arstechnica.com)
submitted 6 months ago by to c/cybersecurity@infosec.pub
7 comments fedilink hide all child comments

top 6 comments

sorted by: hot top controversial new old
[–] 5 points 6 months ago

https://www.cve.org/CVERecord?id=CVE-2026-31431

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 6 months ago

    Do the sysctl mod and you're good until the patch comes out. Such hype.

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 6 months ago (4 children)

    They released the vulnerability without disclosing it to the vendors first? Am I understanding this right?

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 10 points 6 months ago (2 children)

    No, they disclosed it to the Linux kernel security team, a patch was committed to mainline, then this was disclosed publicly. https://copy.fail/#timeline

    They don’t have to coordinate disclosure with every distribution vendor, but droppings public PoC exploit script 28 days after the patch was committed to mainline kind of seems like a dick move to me.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 6 months ago (1 child)

    It technically follows the industry standard rules (and companies who have been exploited have 30 days to disclose breaches in the U.S. so there's probably similar "best practice" stuff with these kinds of disclosures)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • load more comments (1 reply)