Solar Designer <[email protected]> writes: > Hi, > > V3rdant, CC'ed here, brought this Linux kernel issue to linux-distros on > March 18, and apparently also to [email protected] at about the same time, citing > the (outdated) syzkaller "Reporting Linux kernel bugs" instructions: > > https://www.openwall.com/lists/oss-security/2026/05/03/2 > > So we immediately had a coordination problem, which V3rdant acknowledged: > > On Wed, Mar 18, 2026 at 10:28:23PM +0000, x xw wrote: > [...] > It looks like literally everyone dropped the ball on this issue after > that point. This includes two distros who had volunteered for: > > https://oss-security.openwall.org/wiki/mailing-lists/distros#contributing-back > > 9. Stay on top of issues to ensure progress is being made, remind others > when there's no apparent progress, as well as when the public disclosure > date for an issue is approaching and when it's finally reached (unless > the reporter beats you to it by making their mandatory posting to > oss-security first) - primary: Gentoo, backup: Amazon > > I since heard back from Gentoo on this, but no word from Amazon yet.
Indeed. I do think there's a circular element here, which does not excuse the ball being dropped, but I offer it as a partial explanation: the current kernel process makes it challenging to keep track of whether a fix is actually in-flight or whether it's related to a reported problem. But nonetheless, we should've stayed on top of it with the reporter. We're also onboarding another member for the security team as it's just myself at the moment, and we unexpectedly lost another from illness recently. > [...] sam
signature.asc
Description: PGP signature
