122 lines · plain
1====2CVEs3====4 5Common Vulnerabilities and Exposure (CVE®) numbers were developed as an6unambiguous way to identify, define, and catalog publicly disclosed7security vulnerabilities. Over time, their usefulness has declined with8regards to the kernel project, and CVE numbers were very often assigned9in inappropriate ways and for inappropriate reasons. Because of this,10the kernel development community has tended to avoid them. However, the11combination of continuing pressure to assign CVEs and other forms of12security identifiers, and ongoing abuses by individuals and companies13outside of the kernel community has made it clear that the kernel14community should have control over those assignments.15 16The Linux kernel developer team does have the ability to assign CVEs for17potential Linux kernel security issues. This assignment is independent18of the :doc:`normal Linux kernel security bug reporting19process<../process/security-bugs>`.20 21A list of all assigned CVEs for the Linux kernel can be found in the22archives of the linux-cve mailing list, as seen on23https://lore.kernel.org/linux-cve-announce/. To get notice of the24assigned CVEs, please `subscribe25<https://subspace.kernel.org/subscribing.html>`_ to that mailing list.26 27Process28=======29 30As part of the normal stable release process, kernel changes that are31potentially security issues are identified by the developers responsible32for CVE number assignments and have CVE numbers automatically assigned33to them. These assignments are published on the linux-cve-announce34mailing list as announcements on a frequent basis.35 36Note, due to the layer at which the Linux kernel is in a system, almost37any bug might be exploitable to compromise the security of the kernel,38but the possibility of exploitation is often not evident when the bug is39fixed. Because of this, the CVE assignment team is overly cautious and40assign CVE numbers to any bugfix that they identify. This41explains the seemingly large number of CVEs that are issued by the Linux42kernel team.43 44If the CVE assignment team misses a specific fix that any user feels45should have a CVE assigned to it, please email them at <cve@kernel.org>46and the team there will work with you on it. Note that no potential47security issues should be sent to this alias, it is ONLY for assignment48of CVEs for fixes that are already in released kernel trees. If you49feel you have found an unfixed security issue, please follow the50:doc:`normal Linux kernel security bug reporting51process<../process/security-bugs>`.52 53No CVEs will be automatically assigned for unfixed security issues in54the Linux kernel; assignment will only automatically happen after a fix55is available and applied to a stable kernel tree, and it will be tracked56that way by the git commit id of the original fix. If anyone wishes to57have a CVE assigned before an issue is resolved with a commit, please58contact the kernel CVE assignment team at <cve@kernel.org> to get an59identifier assigned from their batch of reserved identifiers.60 61No CVEs will be assigned for any issue found in a version of the kernel62that is not currently being actively supported by the Stable/LTS kernel63team. A list of the currently supported kernel branches can be found at64https://kernel.org/releases.html65 66Disputes of assigned CVEs67=========================68 69The authority to dispute or modify an assigned CVE for a specific kernel70change lies solely with the maintainers of the relevant subsystem71affected. This principle ensures a high degree of accuracy and72accountability in vulnerability reporting. Only those individuals with73deep expertise and intimate knowledge of the subsystem can effectively74assess the validity and scope of a reported vulnerability and determine75its appropriate CVE designation. Any attempt to modify or dispute a CVE76outside of this designated authority could lead to confusion, inaccurate77reporting, and ultimately, compromised systems.78 79Invalid CVEs80============81 82If a security issue is found in a Linux kernel that is only supported by83a Linux distribution due to the changes that have been made by that84distribution, or due to the distribution supporting a kernel version85that is no longer one of the kernel.org supported releases, then a CVE86can not be assigned by the Linux kernel CVE team, and must be asked for87from that Linux distribution itself.88 89Any CVE that is assigned against the Linux kernel for an actively90supported kernel version, by any group other than the kernel assignment91CVE team should not be treated as a valid CVE. Please notify the92kernel CVE assignment team at <cve@kernel.org> so that they can work to93invalidate such entries through the CNA remediation process.94 95Applicability of specific CVEs96==============================97 98As the Linux kernel can be used in many different ways, with many99different ways of accessing it by external users, or no access at all,100the applicability of any specific CVE is up to the user of Linux to101determine, it is not up to the CVE assignment team. Please do not102contact us to attempt to determine the applicability of any specific103CVE.104 105Also, as the source tree is so large, and any one system only uses a106small subset of the source tree, any users of Linux should be aware that107large numbers of assigned CVEs are not relevant for their systems.108 109In short, we do not know your use case, and we do not know what portions110of the kernel that you use, so there is no way for us to determine if a111specific CVE is relevant for your system.112 113As always, it is best to take all released kernel changes, as they are114tested together in a unified whole by many community members, and not as115individual cherry-picked changes. Also note that for many bugs, the116solution to the overall problem is not found in a single change, but by117the sum of many fixes on top of each other. Ideally CVEs will be118assigned to all fixes for all issues, but sometimes we will fail to119notice fixes, therefore assume that some changes without a CVE assigned120might be relevant to take.121 122