Seems like the CVE sequence has, for the first time, reached >100000 this year (Which does not imply 100k vulns though)<p>Apparently by late summer this year, there were already more vulnerabilities found than in all of 2025.
Is there a way to know if a particular vanilla kernel has a particular CVE addressed? Unhelpfully, the ChangeLog-* only seems to contain sporadic references to CVEs.
Are these primarily AI-assisted findings ?<p>Seems like an enormous increase over 2024 and 2025.
That’s probably a great thing. The initial friction of AI overwhelming projects certainly sucks, but once there are better processes to deal with them it’s going to strengthen the quality of so many projects!
1,313 vulnerabilities, to be precise.
I was looking earlier and the majority of these do not have a CVSS score assigned to them yet, but a lot of them that did were >7.0 (although I suppose by nature that the more impactful CVEs are going to be scored more quickly)
Pretty much any kernel bug gets a CVE by default now, right?
Is that all there is here? The quantifier "several" did not prepare me for the wall of CVE numbers in this list.
yes because the majority are memory safety issues, and it's automatically assumed that a memory safety bug can lead to a vuln<p>one again illustrating the importance of encapsulating unsafe behavior. perhaps c should get a __UNSAFE { } block, where memory access is encapsulated and thus most bugs occurring outside of those blocks do not need to be marked as CVEs.
[dead]
[dead]