Remote profile

Gave a 2+ hour lecture at vu.nl today about Linux kernel development and security things that was a lot of fun, the students had great questions about a huge range of relevant topics.

Afterward a student gave me a vanilla cake baked by their grandmother.

Best speaker gift ever.

@heine @muvlon @KernelRecipes @philipmolloy you are right, `make sbom` is newer than 6.18, it showed up in the 7.2 release.

@jbm @KernelRecipes @bagder On nevermind, I can't do math...

@jbm @bagder @KernelRecipes We got CVE-2026-100001 as well :)

Here's a bit more up to date version of the "how many CVEs have we fixed" stats than what I showed earlier this week at @KernelRecipes as I was able to catch up on some reviews on my way home on the train.

Also cve.org just crossed the 100000 numbering barrier just now, first time that ever has happened, hopefully no scripts broke. And yes, the kernel.org CNA has CVE-2026-100000 reserved, need to find a "good" bug for that one, suggestions welcome!
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx

@heine @philipmolloy @KernelRecipes @muvlon Has everyone ignored the 'make sbom' kernel build option that will tell you EXACTLY which files your kernel build uses? You can then cross-reference that with the files in the CVE entry (both of which are in json formats, so script away!)

There's also many other older tools out there to get a simple "here are the files I am using for this kernel build" list, here's my very old version that has been used by Android in the past:
https://github.com/gregkh/gregkh-linux/blob/master/scripts/count_lines

@philipmolloy @KernelRecipes @muvlon Awesome, that's the way to do it, nice work!

@muvlon @KernelRecipes It has that many listed CVEs because our codebase is huge, but you only use a small fraction, so what is relevant for you is much smaller.
Also bugs at our level are CVEs, while userspace programs don't have those same issues.

This is nothing new, other operating systems have the same issues and lists of CVEs. It's just that the corporate OSes don't actually publish all of their vulnerabilities because nothing requires them to, so they don't. Go blame them and the cve.org people, not us!