Linux kernel team publishes 432 CVEs in two days

security

Sunday-to-Monday onslaught fuels speculation over AI-assisted bug reports

If you’re responsible for Linux security, someone just dumped a pile of work onto your desk: 432 Linux kernel CVEs were published across Sunday and Monday this week. Linux watchers at nixCraft pointed out the volume on Monday morning, and it didn’t take long for seasoned sysadmins to start expressing concerns.

Jan Schaumann, chief information security architect at Akamai Technologies, took to the OSS-SEC mailing list Tuesday to express concerns over the sheer volume of Linux kernel CVEs published in recent days. Aside from noting that the CVE system isn’t the best way to track security changes, Schaumann also wondered in his post whether there was any good way to deal with so many kernel security issues.

“This onslaught really shows it’s not feasible to attempt to prioritize individual kernel changes,” Schaumann said. 

“You might attempt to process this large set of changes by pointing an LLM at the intake and asking it to prioritize them,” he suggested, “but if it spits out a dozen today and another 25 the next, you haven’t won much.”

Schaumann also suggested waiting to see which ones emerge as serious issues and focusing on those in the weeks to come, or updating one’s entire fleet of Linux machines on a weekly basis. 

“I sure would like to be able to do [that], but reality keeps getting in my way,” Schaumann said. “I’m not sure what to do here going forward.”

In an email to The Register, Schaumann said that individually reviewing vulnerabilities for patching was already difficult enough before things rose to this level, and that automation may be the only option – but it’s not a great one. 

“Automated, regular, and frequent updates that pull in all changes within a given time window of tolerance seem to me the only reasonable approach, but that is very difficult for many large organizations,” Schaumann explained. Those orgs often rely on lengthy QA processes, slow and staged development cycles, and may even have contractual requirements for long-term support that make an automated approach an impossible one. 

The nixCraft team speculated on social media that AI bug reports are a likely reason for all those kernel CVEs, which wouldn’t be without precedent – Linus Torvalds himself said in May that the Linux kernel security mailing list had become “almost entirely unmanageable” due to AI-assisted bug hunting. Nonetheless, Torvalds has described AI as a useful tool for Linux development while still noting it can be a drag for maintainers, both from a workload standpoint and the fact “it keeps finding embarrassing bugs.”

On that note, it’s worth understanding what a Linux kernel CVE actually means – many of the vulnerabilities included in the Sunday-to-Monday batch are small in scope, but they’re vulnerabilities nonetheless.

As senior Linux maintainer Greg Kroah-Hartman noted in a February blog post, the Linux kernel CVE team follows the CVE Program’s definition of a vulnerability: a weakness in a product that can negatively affect a system’s confidentiality, integrity, or availability.

“At the level that the Linux kernel runs, almost any type of bug that can affect a running system can be classified as a vulnerability,” Kroah-Hartman noted. The kernel team looks at every bugfix that is added to stable kernel releases, he added, and if it fixes an issue that meets that CVE criteria, a CVE is assigned. 

AI-assisted bug hunting has increased the volume of reports reaching Linux kernel maintainers. We reached out to the Linux kernel team, but didn’t hear back. Kroah-Hartman did tell The Register earlier this year that AI bug reports had become worthwhile in recent months, and he predicted they’re likely to keep adding to his workload. 

Unfortunately for Linux sysadmins, the position in which they find themselves in this current mess isn’t one that’s readily solved. CVEs might be a messy way to track and prioritize security updates, especially when hundreds of them are published over a short period, but without something better, it falls to IT and security teams to determine which vulnerabilities affect their systems and which kernel updates they need to deploy.

Hope you’ve got the coffee machine filled up: The onslaught is unlikely to ease if other recent patch cycles are any indication. ®