Some talks just write themselves, @KernelRecipes is going to be fun this year!

(not that it's not fun every year, but you get the idea...)

@gregkh What does this graph mean, then? Are new releases filled with bugs or does 7.0 coincide with a new generation of scanning tools?

@gregkh @KernelRecipes Obligatory.

@Stephanie @gregkh or new generation of generative tools? 😉

@gregkh @KernelRecipes looks like 7.0 has more vulnerabilities than 6.0 :P

@joshbressers @gregkh @KernelRecipes One never knows until they are found.🤷🏻‍♂️

@gregkh @KernelRecipes Likely the title should be “CVEs fixed per release”. A separate graph showing which versions are affected is a way better graph as it would show when a problem was introduced and when the problem was discovered and fixed.

Discovery/fix is shown in the above graph, but it does not show how long that problem was present and thus exploitable.

@jeroen @KernelRecipes I'm not posting all of my graphs here at the moment, you'll have to wait for the talk in a month!

@gregkh @KernelRecipes looking forward ;)

I think that, yes, with LLMs more are discovered and then fixed; but I wonder how many have been introduced recently too.

@gregkh @KernelRecipes Heh ... I have a similar plot from the 7.2 development-statistics article that I'm thinking of using...

@jeroen @gregkh @KernelRecipes the graph I really want is CVEs introduced per release

@esoterra @jeroen @KernelRecipes you have access to the same tools I do, it's easy to calculate yourself!

Hint, 5.15 is the leading "most CVEs created" kernel release for some reason...

@corbet @KernelRecipes Nice graph, glad ours align. Its as if some random tools got a bit better in finding bugs in the past months....

I saw some graphs for curl, which did not only show count but also severity. And that revealed that even though the number of CVEs had gone up overall that was mostly due to lots of very low severity issues.

@gregkh Clearly as this graph shows, changing version Number to 7.x increased the number of CVEs. My recommendation would be to go back to 6.x. - even when this means, Linus has to add some more toes and fingers to his feet and hands to count the number after the dot. I think that price is acceptable for a more secure kernel. We all would benefit from this (and some additional fingers might come handy for Linus' guitar pedal soldering hobby :p )
@KernelRecipes

@gregkh Do long term kernel releases also patch CVEs? And does this graph track those fixes?