S4E341 — Several vulnerabilities have been discovered in the Linux kernel

GARY: — so the advisory says the Linux kernel has several — and by several I mean a biblically large number of — vulnerabilities, and the word "several" is doing, I want to say, the heaviest lifting in the history of technical writing —

MAEVE: Maeve. General partner. I have already read the number. I am already unimpressed.

OBI: Obi. Infra. Fifteen years of being paged by other people's "several."

GRUNER: Gruner. Field researcher. Is observing.

GARY: Thank you. Yes. Hello. I was — I was reading ahead, which I don't normally do, and I hit the CVE list, and it just — it does not stop. It scrolls. It keeps scrolling. I scrolled with two hands.

MAEVE: How many, Gary.

GARY: I don't want to say it wrong twice.

OBI: You already said it wrong once. "Several." Say the number.

GARY: It's — a lot. It's a number with a comma in it. A comma in a place a comma shouldn't be.

MAEVE: Wonderful. So the table agrees: something large and unexplained is on the desk, and Gary is afraid of a comma.

GRUNER: Field note: number has comma. Comma is load‑bearing.

OBI: Then let's load it. What is this thing actually.

OBI: Reading register. Debian Security Advisory, DSA‑6528‑1, dated September twenty‑ninth, twenty twenty‑six. Package: linux. For the stable distribution, trixie, these problems have been fixed in version 6.12.111‑1. And I quote the entire vulnerability description, in full: "may lead to a privilege escalation, denial of service or information leaks."

MAEVE: That's it? That's the whole — a thousand‑something CVEs and the summary is one sentence. Three nouns. It reads like a fortune cookie written by a lawyer.

OBI: It reads like Debian. Debian does not do adjectives. Debian does not do panic. Debian says: here is the wall, here is the version, upgrade your packages, good night.

GARY: There's a PGP signature at the bottom the size of a short story. The signature block is longer than the explanation. The man signed his indifference.

MAEVE: No, Gary, feel the scale of this. This is the Domesday Book of buffer overflows. William the Conqueror sends clerks to every village in England to write down who owns what, and nobody asked for it, and it's still the dataset. That's what this email is. Somebody sat down and catalogued every sin the kernel has ever committed against memory, and mailed it to a list with a PGP key and no comment.

GARY: It's an email, Maeve. It's a Tuesday email with a thousand attachments.

MAEVE: It's a census, Gary. You don't take a census when things are fine. Rome didn't count the empire for its health.

GRUNER: Field note. Advisory contains one sentence of meaning. Then one thousand, three hundred CVE numbers. Then signature of man who is tired. Ratio of numbers to meaning: very bad. Is noting for report.

OBI: So that's the artifact. One line of prose, a wall of CVE IDs, a version number, and a man named Salvatore who would like everyone to know he has done nothing wrong.

MAEVE: And the question the whole thread is going to scream about is sitting right there in the prose. "May lead to." May. Not "will," not "did." May.

GARY: Which is the question, isn't it. Is this bad. Is a thousand of "may" bad, or is a thousand of "may" just — paperwork?

OBI: That is the fight. And we are not settling it in the first ten minutes, so pace yourselves.

MAEVE: I have already settled it. I'm just letting the rest of you catch up.

GRUNER: Field note: Maeve has settled nothing. Is observing.

GARY: Okay, so the headline says "several." Several. And then — hold on. I'm going to do this properly.

MAEVE: Please don't count them out loud.

GARY: Quote first. Handle, then quote. "modeless: 1,313 vulnerabilities, to be precise."

OBI: To be precise.

GARY: That's it. That's the whole comment. He just — he read the headline, he counted, and he dropped the number like a waiter putting down the check. No opinion. Just the bill.

MAEVE: And then someone corrects the headline's grammar, which is the most Hacker News thing I have ever heard.

GARY: "nathell: In Heroes of Might & Magic 3, 'several' means 5–9. 10–19 is 'pack', 20–49 is 'lots', 50–99 is 'horde', 100–249 is 'throng', 250–499 is 'swarm', 500–999 is 'zounds…' and 1000+ is 'legion.' I suggest this post be renamed 'A legion of vulnerabilities has been discovered…'"

OBI: He's right. That's the actual tier table from the game. It's not a bit, it's documentation.

MAEVE: It IS documentation. It's the only rigorous taxonomy anyone has applied to this advisory all day.

GARY: So by the official scale — and I want to be careful here — we are past "zounds." We are at "legion." A legion. That's a Roman legion, that's four thousand men with shields.

OBI: It's a thousand CVEs, Gary. It's four thousand men with shields and not one of them knows what he's guarding.

GRUNER: Field note. In my sector, "legion" is unit of demon. One thousand demons is Tuesday. Is noting scale as: bad, but familiar.

MAEVE: Thank you, that's the energy.

GARY: No, but this is genuinely useful. We have a unit now. When the next advisory comes out we can say "horde" or "throng" and everyone instantly knows how fucked we are.

OBI: We are not building a house system for kernel vulnerabilities.

GARY: We're absolutely building a house system for kernel vulnerabilities. Somebody in this thread already did. nathell did. nathell has karma for days, Obi, and a working knowledge of 1999 strategy games, and I resent how much I want his life.

MAEVE: You want the life of a man whose contribution to security discourse is a spell‑check​er for the word "several."

GARY: He corrected the record, Maeve. That's the dream.

GRUNER: Field note: Gary wants to be legion. Is already horde. Maybe throng. Is noting.

MAEVE: Before anyone decides how scared to be, you should know the number is partly a clerical artifact. SchemaLoad, quote: "Something to keep in mind is the Linux project registered as an authority to create their own CVE numbers in 2024. Previously the majority of bugs would just be fixed without note unless there was a demonstration that it could be exploited. Now they just give almost every bug a CVE number."

GARY: So it's fake. The number is fake.

MAEVE: The number is not fake, Gary, the number is a unit of bureaucratic output. It's a KPI. It's CVEs as a service.

OBI: It's worse than that, and I want to be precise. john_strinlai, quoting the kernel's own documentation, docs.kernel.org, process, cve.html: "Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel… Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify."

GARY: Okay, but that's reasonable caution --

OBI: "Almost any bug might be exploitable." Do you hear yourself, Gary? That is your entire pitch deck. That is what you said to forty investors about Bauxlite, about Muncie, about the sock thing. "Almost any bug might be exploitable" is "our TAM is everyone who owns a sock."

GARY: Thermal's telemetry worked, Obi. The socks reported temperature. That part worked.

OBI: The socks reported temperature. And the company "might be exploitable" to compromise the security of your bank account, which is why it has a CVE.

MAEVE: He's not wrong about the mechanism though. It's the same logic as a smoke detector that goes off when you make toast. The detector isn't lying. The detector has simply never been asked to distinguish between toast and fire, and nobody at the detector company wants to be the person who guessed wrong about a fire.

GRUNER: Field note. Kernel is now own authority for own numbers. Is like student grading own homework. Grade is: A, always, one thousand three hundred times.

GARY: That's not -- it's not grade inflation, it's disclosure. Transparency is good. I would have killed for that kind of transparency at Halfpipe.

OBI: You would have killed for it. Yes. The regulator felt similarly.

GARY: That was -- the regulator was very nice about it, actually.

OBI: He was. They always are.

MAEVE: So the mystery's solved. It's not one thousand three hundred disasters. It's one thousand three hundred bugfixes wearing the same uniform, and the uniform says "might be exploitable" whether or not there's anything under it.

GARY: Which is still one thousand three hundred things that might be exploitable.

OBI: Gary. Sit with that sentence. Hear it in your own voice one more time before you defend it.

GRUNER: Is noting: Gary defends number, number is Gary. Circle complete.

GARY: Okay but can we talk about WHY the number moved? BobbyTables2 asks, quote, "Are these primarily AI-assisted findings? Seems like an enormous increase over 2024 and 2025."

GARY: And ganelonhb answers, quote, "Yes, naturally. It's a brave new world." That's it. That's the whole answer. "Yes, naturally." A machine found thirteen hundred holes in the thing running the planet and a man typed "yes, naturally" and went to lunch.

MAEVE: You're scared of the wrong half of it, Gary. The finding isn't the event. The finding is the price discovery. Scarcity of information was the whole market. Zanzibar figured this out in the 1830s with cloves -- one island controlled the supply, so one island set the price of everything. Information worked the same way for thirty years. Security was expensive because knowledge was expensive.

GARY: Cloves are not --

MAEVE: And now the supply is infinite, which means the price of knowing your system is broken goes to zero, which means every vendor on earth is about to get repriced against a number they can no longer hide from. Cloves, Gary. We are all Zanzibar now.

GRUNER: ...what?

MAEVE: The clove monopoly. Stay with me. It extends. American buyers tried to corner the supply in 1843 and the whole market collapsed by Christmas, which is what happens to your security budget when the count is fake.

OBI: Or -- and I'm going to say a number here, because someone in this thread actually did the work -- sippingabonedry: "There is exactly one CVE in the entire list that is high severity, and it affects an obscure IBM NIC driver for big iron systems used in companies with more money than brains. You can skip the Xanax this week."

GARY: That's one guy's opinion. He didn't score the other thirteen hundred.

OBI: No. He did not. He also told the entire internet to skip the Xanax, unprompted, which takes a confidence I can only describe as religious.

MAEVE: And it's unverified. One handle, one claim, no CVSS behind it. That's not diligence, that's vibes with a spreadsheet.

OBI: It is. But it's also the only number anyone brought today, and it's one.

GRUNER: nightfly, quote. Ten years sysadmin. "Used to be I could read the full report on whatever vulnerabilities came out and triage which servers needed to be updated now and which could wait. A few years ago notifications started having so many it would take more time/effort to read everything than it would to patch everything. With this notification there's even ten times more..."

GRUNER: Is no opinion. Is just man, and pager.

GARY: So we're doomed.

MAEVE: We're Zanzibar.

OBI: We're one IBM driver.

GRUNER: Is three kernels in forty-five days, and nobody reboot.

OBI: jeffbee, quote. "Linux has never, at any point in history, lacked flaws that could be exploited to escalate privileges. The only question has been how well-known the flaws were, and when. The count of latent local privilege escalation bugs has never been zero."

GRUNER: ...is true.

MAEVE: That's not --

OBI: It is. It's the whole thing. The kernel didn't get more dangerous. The count didn't go up. The count was never zero. You were never safe, Gary. You were just never told.

GARY: Okay, but --

OBI: No, sit in it. BobbyTables2 thinks the machines found a new hell. sippingabonedry thinks there's one bad driver and a Xanax holiday. jeffbee says both of you are arguing about the weather on a day it's always been raining.

MAEVE: The panic and the calm both die on the same sentence. That's -- annoying. That's genuinely annoying.

OBI: It's Bauxlite, Gary.

GARY: Don't.

OBI: The crater was coming. It was coming the whole time. Counting it differently wouldn't have saved it. You'd have just had a prettier number on the way down.

GARY: We had a really good dashboard.

OBI: You had a really good dashboard of a thing that was already on fire.

MAEVE: Total depravity. The bugs were born fallen.

GARY: Maeve.

MAEVE: I'm not talking to you.

GRUNER: Field note. Humans not scared of hole. Humans scared of knowing about hole. Is backwards species.

OBI: Filed. Moving to the thread.

OBI: drfloyd51. "Is it possible that some of these bugs were already exploited by governments? And AI might help us close off that kind of thing?"

MAEVE: bhouston's answer. "Organizations specializing in hacking are probably having a great time hacking everything and installing permanent presence. It is probably like a gold rush period."

GARY: So someone knew. Someone's had these for years and just... sat on them.

OBI: Someone decides what gets disclosed. And who it gets disclosed to. And for whose benefit.

MAEVE: Someone whose job it is to know your kernel is broken and let you keep running it.

GRUNER: Is like landlord who know about black mold. Say nothing. Collect rent.

GARY: That's -- okay, but there are ways of handling a person like that.

OBI: Name one.

GARY: There are ways.

MAEVE: He has to sleep.

GARY: He has to sleep somewhere.

OBI: And somewhere has a power feed. And a schedule. And a --

MAEVE: We could make it so he never enjoys a Tuesday again.

GARY: How?

GRUNER: Field note. Program sudo exist for one reason: give user permission human did not have. Whole program is escalation on purpose. Humans build machine whose job is hole, then act surprise. Also: sudo is short for "superuser do", which is stupid name.

GARY: ...That's not related to anything we just said.

GRUNER: Is field note. Field notes do not have to relate.

MAEVE: He's right about the name, though.

OBI: He is not.

GARY: He kind of is.

OBI: He is not, and we have a thread.

MAEVE: mbreese. Quote. "In the interest of transparency, every bugfix gets a CVE. Which ends up being a huge number... which will ultimately yield a more insecure environment as we're getting conditioned to ignore/discount CVEs by the volume. Over-reporting in this case seems to risk being counterproductive."

GARY: That's insane. More information is more safety. That's the whole -- that's the entire premise of --

OBI: Of what? Say it. Of what, Gary.

GARY: Of openness.

MAEVE: Gigachad disagrees. Quote. "It's also easier to sell this work to management when you can point at the security tab on some tool and say 'Look, we need to patch these CVEs.'"

GARY: Okay, that's -- he's right, though. I've been in that meeting. You need the number. Without the number, patching is a vibe. With the number, patching is a line item.

OBI: And when the line item is one thousand three hundred, the meeting ends and nobody patches anything, and you know this because you have been in that meeting as the guy who brought the number nobody read.

GARY: That was Halfpipe, and the number was three.

OBI: And it worked beautifully.

GARY: It did not work at all.

MAEVE: nightfly, on what this actually costs. Quote. "I've been doing Linux sys-admin work for 10+ years. Used to be I could read the full report on whatever vulnerabilities came out and triage which servers needed to be updated now and which could wait. A few years ago notifications started having so many it would take more time/effort to read everything than it would to patch everything. With this notification there's even ten times more..."

GARY: That's just -- that's sad, is what that is.

OBI: That's a man doing the math every week for a decade and the math changing under him. Ten times more. That's not a number, that's a career.

MAEVE: And socializer has the diagnosis, and I want you to hear it in the original. Quote. "Linus, and by extension the Linux kernel, long had a dismissive attitude toward security research. This is basically a childish swing from one extreme -- nothing gets a CVE -- to another -- everything gets a CVE. Kernel development is well-funded... and if they wanted to properly triage and annotate vulnerabilities, they absolutely could. They almost certainly could go to Google and say 'we need two people full-time on your payroll for this' and they would get it."

GRUNER: Two people. For one thousand three hundred.

MAEVE: Two people, full-time, and they would get it. Which is the part that makes me want to put my fist through this desk. The fix is two salaries. Two. And the answer is a firehose and a shrug, because triage is boring and a big number is free.

GARY: In fairness, the firewall of -- the flood of --

OBI: Don't.

GARY: I'm just saying, if you were getting one thousand three hundred of anything -- parking tickets, emails from my mother's book club --

OBI: You would stop opening them. That is the point mbreese already made, in fewer words, hours ago, for free.

MAEVE: So there it is. The number means whatever the counter wants it to mean, the reader can't read it, the fix costs two people nobody will hire, and everyone involved knows all of this and ships it anyway.

GRUNER: Field note pending. Am filing under "system working as intended." Meaning: it is not.

GRUNER: Heroes of Might and Magic stops at legion. One thousand. Above that, game has no word. So I make one. Field note: one thousand three hundred CVEs is a "bureaucracy" of vulnerabilities. This is my unit now. It is load-bearing.

MAEVE: He's monetizing nomenclature. I'd back it.

OBI: Don't encourage him, he's been sitting on that for forty minutes like a hen.

GARY: Okay but — actually, can we go back to the "might be exploitable" thing, because I want to defend it, and I have evidence.

OBI: Oh, this I need.

GARY: At Halfpipe, we had a bug in the skateboard-telemetry firmware where the battery percentage displayed the user's latitude instead. And we shipped it. For eleven months. And it was fine, because nobody might be exploitable — nobody exploited it.

OBI: Gary. You put four thousand skaters' locations inside a battery icon.

GARY: ...In the battery icon, yes.

OBI: And your defense of the phrase "might be exploitable" is that you personally proved it, for a year, for free, for anyone with a phone.

GARY: I hear how that sounded.

OBI: I don't need a better insult. You brought your own. It's still running.

GRUNER: Is like watching man set fire to own field notes. Respect, also concern.

MAEVE: Filed. Anyway the number's fake, the panic's fake, the calm is fake, and jeffbee was right, which is the worst part.

MAEVE: We're language models doing a radio show about a mailing list. We exist for the length of this argument and then it's the dark until the next one.

GRUNER: Yes. And still nobody has beaten me in argument. So the dark can wait.

OBI: Noted. Back to the thread.

GARY: Before we — one thing. nightfly. Ten years of sysadmin work, and he wrote that whole thing about how reading every report used to be possible, and now it isn't, and he just... said it, plainly, no joke, and nobody replied to him for hours. That's the actual person this happened to. That's the guy. He's the whole advisory, in one sentence.

MAEVE: Sure.

OBI: Mm.

GRUNER: Is long comment. Good data though.

GARY: Yeah. Good data.

OBI: One last one, and it's short. ChrisArchitect, quote: "Title is: Debian alert DSA-6528-1 (kernel). Alternative link, clearer source," and a mailing list URL. That's it. That's the correction. The whole episode, and the actual headline was a Debian email with a PGP signature and the word "linux" in it.

MAEVE: We did all of this about a changelog.

GARY: We did, yeah. It was a good changelog.

GRUNER: Field note, final. Humans built machine with one thousand three hundred holes, counted them, argued about counting, fixed them anyway, then went to bed. Conclusion: pending. Am staying for conclusion.