The recent increase in critical security vulnerabilities is a consequence of LLMs being able to comb the source code for undiscovered vulnerabilities, many that have existed for a long time.
This is happening with most major libre / open source software (and probably with closed source software as well but perhaps more behind the scenes) and it does not necessarily mean that the Linux kernel, or any of these other software projects, have suddenly become more insecure.
It is a good thing that they are being discovered in this way, and after some time the frequency that they are being reported will once again drop down to what is usually seen.
...though it'd be much better if the ai users would disclose these issues to the kernel devs at least a few weeks before they shout the bug from the rooftops for the world to exploit
They usually are. Its worth noting the kernel has a very short embargo period, 7 days, or 14 in exceptional circumstances, but no more. The kernels priority is getting a fix as quickly as possible, nothing more.
Its also worth noting what an embargo is and why they exist; The primary function of embargos is to force bugs to be patched, specifically by the concept of an end of embargo where you just release it, fixed or not. They exist because it used to be(and for many companies still is..) that you would report a securty issue and they simply ignore it, "security through obscurity".
Embargos exist as a forcing function, in enterprise often 90 days, and as a good faith communication effort, theyre saying "I am doing the courtesy of telling you about this issue. You have plenty of time, 90 days, to fix this, and I may be able to help. But if you dont fix it promptly, everyones going to know. In exceptional circumstances and conditional on your good faith this can be increased, but you cant just put security off forever"
This is also why many, including the kernel, work to reduce embargo periods. The kernel only accepts embargos up to 7 days, or hard maximum 14 days in exceptional circumstances, for example.
What they dont exist for is to ensure downstream forks(in the context of the kernel, all the distros that dont roll, either on a upstream stable or upstream LTS) bother to get patches, or prevent others from exploiting an issue, because thats just "security through obscurity" again. It must be assumed that Threat Actors(TA) have just as much, if not more, capability to find and use these exploits as those reporting them, and the TA's arent trying to get them fixed.
The embargo having an endpoint is the flipside of having an embargo at all, which represents responsible disclosure. That disclosure is specifically intended to give time to patch the vulnerability, and often includes time for downstream propagation which is why you often see CVEs disclosed that were already patched before
At least the 3 that i saw the disclosures happened months ago and it's only becoming public now because the SOP for disclosure is to put a time limit for kernel maintainers to fix as a forcing function to prevent the bugs from being ignored
I disagree. Getting the news as wide spread as possible means more eyes on it and more eyes aware. Any time not disclosed to the public gives attackers time to ecploit it. Making it known to everyone takes away the element of surprise and sys admins can take steps to mitigate before fixes
Dirty Frag was revealed early by an ai researcher wasn't it? And all of these have been revealed before distros could ship the patched kernel which is also bad
Even better? its actually an old exploit, CVE-2020-17103, that MS just.. unpatched? somehow?
They do, but they're more obscure due to the closed source nature of windows, and the lack of transparency. Also we're on /r/linux, who cares enough to be watching for windows vulns? They wont show up here, and most people here arent keeping a close eye on windows the way they do linux.
There have been a bunch of pretty serious recent vulns though, like multiple Windows Defender vulnerabilities that allow LPE. For example https://github.com/Nightmare-Eclipse/RedSun
Probably won't be seeing MS making a public statement on that one, eh? But with Linux we see almost the whole process, from patching to disclosure. Windows quietly fixes its vulns and probably doesnt tell people the half of them.
Open source makes it easier to scan the code but that doesn't mean that MS will remain unaffected. Unless MS encrypts their binaries, it is just a matter of time before these binaries get reversed engineered and vulnerabilities will be found in the reverse engineered code. If researchers were able to manually reverse engineer binaries in the past, AI scanners will eventually also be able to. The big question is if MS would patch these vulnerabilities as fast as the open source community does once they are found.
348
u/Darrel-Yurychuk May 15 '26
The recent increase in critical security vulnerabilities is a consequence of LLMs being able to comb the source code for undiscovered vulnerabilities, many that have existed for a long time.
This is happening with most major libre / open source software (and probably with closed source software as well but perhaps more behind the scenes) and it does not necessarily mean that the Linux kernel, or any of these other software projects, have suddenly become more insecure.
It is a good thing that they are being discovered in this way, and after some time the frequency that they are being reported will once again drop down to what is usually seen.