Home | Notifications | New Note | Local | Federated | Search | Logout
Note Detail
Reply to @dalias@hachyderm.io
Cassandrich@dalias@hachyderm.io (2026-09-29 22:14:41)
@jschauma As an example, I pulled out a random CVE number from the giant list and looked at it:
https://www.cve.org/CVERecord?id=CVE-2026-97990
There is nothing in the report to indicate anything resembling a vulnerability. Maybe it is, but the report is just a normal bug fix for incorrect interpretation of an error return value.
It may be that this leads to OOB accesses later, but that is not established. Nonetheless, a CVE was assigned. 🤬
---Reply---
Jan Schaumann@jschauma@mstdn.social (2026-09-29 22:18:16)
@dalias Yep. It's the kernel team's decision to assign a CVE ID to just about any change. Combined with the onslaught of AI findings, this gets us to thousands of CVEs, and trying to assess which, if any, are meaningful and affect your particular stack and configuration is, IMO, no longer possible.
Reply
---Replies---
Cassandrich@dalias@hachyderm.io (2026-09-29 22:19:26)
@jschauma Because the kernel team is actively promoting the slopbros' agenda. 🤬