one again illustrating the importance of encapsulating unsafe behavior. perhaps c should get a __UNSAFE { } block, where memory access is encapsulated and thus most bugs occurring outside of those blocks do not need to be marked as CVEs.
I think the convention for this is at the filesystem level and most programmers use the `.c` suffix to indicate it
perhaps we could call it a sedimentchest?
Seems like an enormous increase over 2024 and 2025.
Apparently by late summer this year, there were already more vulnerabilities found than in all of 2025.
https://security-tracker.debian.org/tracker/source-package/l...
Searching around, the best I have found so far for vanilla kernels is: https://linuxcvetracker.com
It does require a little clicking around to get all the info I want though. Time to pull out curl+awk! :)
Wonder how many of these NSA and others been sitting on, for how long and how many are still there? I guess the silver lining with the aixplosion of CVEs is that software eventually will get more secure.
Now they just give almost every bug a CVE number.
Remotely or locally exploitable? This is very lacking on information.
>“Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel… Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify.”
https://docs.kernel.org/process/cve.html
"number of cves" is a useless metric, especially when it comes to the kernel.
If you're willing to stretch, missing but planned features also deny the use of said features since they haven't been added yet, and so are CVSS 1/Low vulnerabilities.
Resume-driven development for security researchers has never been easier!
modeless•1h ago
nathell•17m ago
I suggest this post be renamed “A legion of vulnerabilities has been discovered…”