Conversation
bagder@mastodon.social

daniel:// stenberg://

@gregkh Hi Greg, do you have any chart/slide to share showing Linux kernel CVEs/year or something illustrating the 2026 "explosion" ? Could fit well in a talk I will do soon. Just asking if you have something done already to share.

1
0
1
janne@treehouse.systems

Janne Grunau

Reply to @bagder@mastodon.social

@bagder @gregkh posted last week https://social.kernel.org/objects/63e1e7cf-8000-455d-951a-a289059e73bc

1
0
0
bagder@mastodon.social

daniel:// stenberg://

Reply to @janne@treehouse.systems

@janne @gregkh ah yes, now I even recall having seen that. Thanks!

1
0
0
gregkh

Greg K-H

Reply to @bagder@mastodon.social
@bagder @janne I can give you raw numbers if you want as well, so you can use it in your own graphing tools, I'll email them to you...
2
0
3
bagder@mastodon.social

daniel:// stenberg://

Reply to @gregkh

@gregkh @janne ah cool, thanks!

0
0
0
bagder@mastodon.social

daniel:// stenberg://

Reply to @gregkh

@gregkh @janne

5
0
0
benbe@social.chaotikum.org

BenBE

Reply to @bagder@mastodon.social

@bagder @gregkh @janne Now the unfair comparison with cURL … ;-)

1
0
0
urixturing@hachyderm.io

Urix Turing

Reply to @bagder@mastodon.social

@bagder @gregkh @janne talking about vulnerapocalypse https://www.theregister.com/security/2026/09/09/microsoft-breaks-patch-tuesday-record-with-974-cve-deluge/5295160

1
0
0
_nibbles@mastodon.social

Johan

Reply to @bagder@mastodon.social

@bagder @gregkh @janne

Without context one might say that Linux is not very secure 😑

0
0
0
bagder@mastodon.social

daniel:// stenberg://

Reply to @benbe@social.chaotikum.org

@benbe @gregkh @janne the kernel is 200x the amount of code compared to curl but not 200x the number of CVEs...

0
0
0
bagder@mastodon.social

daniel:// stenberg://

Reply to @urixturing@hachyderm.io

@urixturing @gregkh @janne yeps, or converted to a Daniel slide

1
0
0
bagder@mastodon.social

daniel:// stenberg://

Reply to @bagder@mastodon.social
Edited 2 hours ago

@urixturing @gregkh @janne curl has more modest numbers but the same trend

0
0
0
icing@chaos.social

Stefan Eissing

Reply to @bagder@mastodon.social

@bagder @gregkh @janne This red color looks dangerous. Isn‘t it good they are found?

*ducks*

1
0
0
bagder@mastodon.social

daniel:// stenberg://

Reply to @icing@chaos.social

@icing @gregkh @janne isn't that the color of love? 😁

1
0
0
icing@chaos.social

Stefan Eissing

Reply to @bagder@mastodon.social

@bagder @gregkh @janne I admit, I have not recognized the H1 love letters as what they are. This changes everything!😍

0
0
1
gregkh

Greg K-H

Reply to @bagder@mastodon.social
@bagder @janne Hey, "red" is bad, but in this case, it should be "good" in that we are fixing lots of old debt here. It's not like we are adding more buggy code, as the "where was the CVE introduced" numbers show.
But it's your graph, you pick whatever color you want :)
2
0
3
libewa@chaos.social

libewa progress_pride

Reply to @gregkh

@gregkh @bagder @janne
Don't the "introduction" numbers show pre-git Linux as second place? (1st place I think introduced NTFS and more)

1
0
0
bagder@mastodon.social

daniel:// stenberg://

Reply to @gregkh

@gregkh @janne in this case I use red for "hey look this is the number that stands out compared to the rest". There's some blabbing associated with it too that should clarify how it can be viewed and interpreted.

0
0
0
gregkh

Greg K-H

Reply to @libewa@chaos.social
@libewa @bagder @janne For CVEs, no, the numbers do not show that at all, it's 5.15 that is the "highlight". But note we didn't really start tracking CVEs until 2024, so historical data is going to be hard to compare properly.
0
0
0
About social.kernel.org

Terms of service

  1. Please do not use this service in violation of the Linux Kernel Code of Conduct. Doing so will result in your account suspension with the referral of the matter to the CoC committee.

  2. "Repeating"/"boosting" someone else's status on this platform will be treated as endorsement and will fall under rule #1.

  3. You are encouraged to use this platform to promote your work on the Linux Kernel, but there is no restriction on permitted topics (with the exception of anything covered by #1 above).

  4. There is no requirement to post in English, but it should be considered the primary language of communication on this platform.

Privacy notice

The admins of this service have access to all posted statuses. They aren't looking, but if it's something they shouldn't know about, then you should not post it on this platform.

Please see the Linux Foundation Privacy Policy, which applies to this platform as well.

Getting your own account

If you would like an account on this instance, please check that the following applies to you:

  • You are listed in MAINTAINERS or CREDITS

  • OR: You have a kernel.org account or email address

  • OR: You have a long and established history of involvement with the Linux Kernel

If the above is true and you agree with the Terms of Service and Privacy Notice listed above, please use these instructions to request an account: