Stupidity . . . or not [LWN.net]

Stupidity . . . or not

Posted May 8, 2026 0:02 UTC (Fri) by himi (subscriber, #340)
In reply to: Stupidity by jpeisach
Parent article: Dirty Frag: a zero-day universal Linux LPE

Quoting from the README.md on the repo:

> Because the embargo has currently been broken, no patch or CVE exists. After consultation with the
> maintainers on linux-distros@vs.openwall.org and at their request, this Dirty Frag document is being
> published. For the disclosure timeline, refer to the technical details.

In other words, the publication of this information was done in consultation with, and at the request of, the kernel and distro security groups - not something that deserves to be called "stupidity". Particularly given there's a pretty simple mitigation (blacklisting and removing the vulnerable modules).

to post comments

Stupidity . . . or not (and apologies)

Posted May 8, 2026 0:07 UTC (Fri) by jpeisach (subscriber, #181966) [Link] (5 responses)

> In other words, the publication of this information was done in consultation with, and at the request of, the kernel and distro security groups - not something that deserves to be called "stupidity". Particularly given there's a pretty simple mitigation (blacklisting and removing the vulnerable modules).

Yes, but now there is actual public discourse on this, so it can be exploited.

Also: stupidity wasn't appropriate, I should've just said that I strongly disagree with the approach.

Stupidity . . . or not (and apologies)

Posted May 8, 2026 0:33 UTC (Fri) by Nahor (subscriber, #51583) [Link]

And there is also much public discourse on the uselessness of embargoes with the advent of LLMs, that they now protect the exploiter as much as the exploited.

Stupidity . . . or not (and apologies)

Posted May 8, 2026 1:57 UTC (Fri) by Heretic_Blacksheep (guest, #169992) [Link] (3 responses)

It would be negligent if there weren't workarounds that most people could deploy immediately assuming they don't use kernel IPSEC in their environment in this specific case. Once the embargo is broken, it's *broken*. The cat is out of the bag and there's no putting it back in. This *is* the responsible thing to do for the community. We don't live in a binary world (pun intended). From any given POC, obscure origin or not, there's only a few hours on average before exploitation begins. Prepare to see a lot more of these as people use *LMs to summarize and engineer exploits as soon as patch code becomes public regardless of embargo status.

Embargos are becoming obsolete in a world where anyone can deploy LM tooling to summarize fixes and produce chained exploits in moments. Every scriptkiddie has the potential to deploy fully functional, sophisticated attack tools now. Open source or closed source are immaterial because the LMs can also reverse engineer machine code. This will be the norm until all the low hanging (read financially/resource cheap) fruit is already picked.

Stupidity . . . or not (and apologies)

Posted May 8, 2026 7:29 UTC (Fri) by gf2p8affineqb (subscriber, #124723) [Link] (2 responses)

Are there actual examples of LLMs finding security bugs through disassembly at scale? Or is that conjecture on your part.

Stupidity . . . or not (and apologies)

Posted May 8, 2026 9:02 UTC (Fri) by eru (subscriber, #2753) [Link]

You could use Ghidra to decompile code, then use LLM on the result.

Stupidity . . . or not (and apologies)

Posted May 8, 2026 10:41 UTC (Fri) by justincormack (subscriber, #70439) [Link]

Yes there is this RCE bug in GitHub that was found through reverse engineering of the GitHub Enterprise binaries https://www.wiz.io/blog/github-rce-vulnerability-cve-2026...