The kernel CNA assigned their 10000th CVE last week, CVE-2025-68750

So far the “stats” look like:

 Year	Reserved	Assigned	Rejected	 A+R		Returned	Total
  2019:	   0		   2		   1		   3		  47		  50
  2020:	   0		  17		   0		  17		  33		  50
  2021:	   0		 732		  24		 756		  16		 772
  2022:	   3		2041		  47		2088		   0		2091
  2023:	   1		1464		  47		1511		   0		1512
  2024:	   6		3069		  96		3165		   0		3171
  2025:	  73		2421		  39		2460		   0		2533
 Total:	  83		9746		 254		10000		  96		10179

Note, the “year” is the year the bug was fixed in the kernel tree, NOT the year the CVE was applied for/assigned.

Rare footage of @gregkh signing an autograph with the phrase "do not use old kernels!" at Open Source Summit Korea 2025, after one of his sessions.

#Linux #OpenSource #OpenSourceSummit

Just found that the 2026 edition of the Linux Plumbers Conference will be in Prague 🇨🇿 , Oct. 5-7, on the same week as Open Source Summit Europe and Embedded Linux Conference Europe.

Save the dates and see you there! That's too early to book my train tickets though 🤔

https://lpc.events/event/20/

Whenever I see a “rice my Arch #Linux w/hyprland” video, I’m like:

You think that’s badass? You should’ve tried getting X11 running on a Linux machine in the mid-90s. You needed your monitor & video card manuals & a calculator (seriously) so you could calculate “modelines” for your X11 config file.

If you got the math wrong you’d fry your monitor by driving it at too high a frequency (back then nearly all monitors were fixed-frequency).

Typing “startx” for the first time was *so* stressful.

Stephen Rothwell is "stepping down as #Linux-Next maintainer on Jan 16, 2026. Mark Brown [@broonie] has generously volunteered to take up the challenge.":

https://lore.kernel.org/linux-next/20251218180721.20eb878e@canb.auug.org.au/T/#u

To quote: ""It seems a long time since I read Andrew Morton's "I have a dream" email and decided that I could help out there - little did I know what I was heading for.""

Many many thx Stephen for all your really hard work on this over all those years, it helped a tremendous lot!

#LinuxKernel #kernel

Interesting tidbit about Rust as used in the Android OS: to prevent the trusting trust attack, and not rely on rust-lang.org build, they bootstrapped rustc 1.19 with mrustc (0.8.0), and then built all following rustc versions with their previous version.

https://cs.android.com/android/platform/superproject/main/+/main:prebuilts/rust/bootstrap/README.md

#RustLang #Android #Toolchains #Bootstrapping #TrustingTrust

Rust is is not a "silver bullet" that can solve all security problems, but it sure helps out a lot and will cut out huge swatches of Linux kernel vulnerabilities as it gets used more widely in our codebase.

That being said, we just assigned our first CVE for some Rust code in the kernel: https://lore.kernel.org/all/2025121614-CVE-2025-68260-558d@gregkh/ where the offending issue just causes a crash, not the ability to take advantage of the memory corruption, a much better thing overall.

Note the other 159 kernel CVEs issued today for fixes in the C portion of the codebase, so as always, everyone should be upgrading to newer kernels to remain secure overall.

Two different ways to help track kernel commits across the different kernel branches, depending on your use case (bash + big git repo, or binary + sqlite db). I use them both on a daily basis: http://www.kroah.com/log/blog/2025/12/15/tracking-kernel-commits-across-branches/

Starting to write up a series of articles about the Linux kernel CVE work that has happened in the past 2 years, starting with some "back to basics" information about how Linux kernels are numbered as many people/companies really don't know how we do this, and it matters a lot in tracking bugfixes and how to determine "vulnerable" and "fixed" kernel releases:
http://www.kroah.com/log/blog/2025/12/08/linux-cves-more-than-you-ever-wanted-to-know/
and
http://www.kroah.com/log/blog/2025/12/09/linux-kernel-version-numbers/

Unpopular opinion: a vulnerability that was disclosed privately by researchers and had a coordinated response from vendors and service operators under an (albeit short) embargo is not a “0-day”.

#InfoSec #CVD

Next week I'll have a talk at Open Source Summit Japan 🇯🇵:

"We need an open source phone OS - postmarketOS!"

If you are there in-person, say hello, and otherwise a live stream (December 10th, 11:40 UTC+9) should be available, and the recording will appear also at some point!

https://ossjapan2025.sched.com/event/29Fpa/

#OSSummit #postmarketOS #MobileLinux #LinuxMobile #DigitalIndependence

The European Union has now published a great page about the Cyber Resilience Act that contains a 66 page FAQ about lots of things in "plain english": https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation

The last 5.4.y kernel release has now happened: https://lore.kernel.org/all/2025120319-blip-grime-93e8@gregkh/

Please don't use this branch anymore, it's really old, and pretty obsolete, and has over 1500 unfixed CVEs in it:
https://lore.kernel.org/all/2025120358-skating-outage-7c61@gregkh/

And if you are stuck with that kernel version for some reason, go ask your vendor to fix those 1500+ CVEs, otherwise you are paying for support that doesn't actually do anything for you...

Three stable kernels for Monday

https://lwn.net/Articles/1048755/ #LWN

As pointed out on an irc channel, yet another example of kernel developers having to do crazy things to paper over hardware bugs: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f076ef44a44d02ed91543f820c14c2c7dff53716

It has now been 0 days since a AI-hallucinated "security report" was sent to the kernel security team.

Right now we seem to be averaging about 1 per week, not bad overall probably compared to other projects.

To be fair, a real security bug was recently found with an "ai tool", but the authors of that at least took the time to verify it was real before sending it to us, and they provided a patch, so not all is doom and gloom.

The European Union Agency for Cybersecurity (ENISA) is now a Root in the CVE Program

https://www.cve.org/PartnerInformation/ListofPartners/partner/ENISA

"If you're not using the stable kernel, your system is insecure. [...]
I'll call out Debian: Debian tracks our kernels very well. Debian runs the world. Over 70% of all servers in the world run Debian. Everything else is a rounding error [...]
👉 Debian: really, really good. I work with the Debian developers all the time. I can't recommend them enough. Their systems are good.
👉 RedHat, SUSE: they have their own weird systems -- talk to them, you're paying them."

@gregkh at https://youtu.be/dhu8HSOzxd8?t=1226

How big is lore.kernel.org? I counted 17,154,017 unique message-ids.

I think that's roughly how many emails @gregkh replies to every day.

The recording from the "#Kernel CVEs are Alive, but Do Not Panic!" talk @gregkh gave last week at #OSSummit Korea is online now:

https://www.youtube.com/watch?v=dhu8HSOzxd8

Sides:

https://git.sr.ht/~gregkh/presentation-cve-is-dead/blob/master/cve-alive.pdf

#Linux #LinuxKernel #kernel #OSSummitKorea #CVE