News for hackers. Stuff that matters.

A comment on CopyFail was not disclosed to Gentoo developer. Parent comment

Re:CopyFail was not disclosed to Gentoo developer by staticassertion on Thursday April 30, 2026 @05:43PM (#47968606)
Greg and Linus do not believe in the entire concept of "vulnerabilities" in the Linux kernel and do not believe in the methods that distros use like cherry picking, therefor they typically are against issuing CVEs, scoring CVEs, describing vulnerabilities at all (if you use the word "vulnerability", your patch will be rejected), etc.

It's fundamentally their position to not work the way that you describe.

[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by baggy_trough on Thursday April 30, 2026 @05:50PM (#47968681)
That doesn't really seem to map onto the situation since Greg himself released a 6.12 with the patch earlier today.
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by staticassertion on Thursday April 30, 2026 @05:55PM (#47968738)
I don't know what you mean at all. I'm just repeating known kernel policy here. What does 6.12 have to do with anything?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by baggy_trough on Thursday April 30, 2026 @06:55PM (#47969345)
What is your interpretation of why Greg KH released a version of 6.12 with this fix in it today, other than to help distributions avoid this vulnerability?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by staticassertion on Friday May 01, 2026 @07:50AM (#47973685)
Why would he ever... not release a new version???? The commit for a fix was in early April, you know.
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by baggy_trough on Friday May 01, 2026 @11:05AM (#47975653)
If he doesn't believe in the "concept of vulnerabilities" then it is remarkable that he released a 6.12 targeted on this one fix. Why would he do that otherwise?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by staticassertion on Friday May 01, 2026 @12:18PM (#47976537)
Sorry but he literally doesn't and nothing you say is going to change that he has explicitly stated that. This isn't up for debate, go ask him yourself, literally go to the first blog post on his site.

As for the latest patch, Greg is currently being forced to clean up a big fucking mess by external parties. And he's miserable about it.

[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by Hendrikto on Friday May 01, 2026 @06:35AM (#47973165)
I would like to read more about this. Do you have a source?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by staticassertion on Friday May 01, 2026 @07:51AM (#47973696)
http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignmen...

I'd start with Greg's on words. You can probably find more on it from Spender/grsecurity's blog.

[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by SiempreViernes on Friday May 01, 2026 @03:14PM (#47978894)
The claims you make upthread are very hard to match with the text you link to, did you past the wrong URL?
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by staticassertion on Saturday May 02, 2026 @08:18AM (#47985765)
No, that's the correct URL.
[ Parent | on HN ]