Greg Kroah-Hartman
Everything, newest first — across every channel. Their profile → · Subscribe
Hiding
3 November
2 November
1 November
15 October
16 February
From one piece Linux CVE assignment process 3 beliefs, in the piece's order there
-
korrents.com
NIST/NVD's assignment of CVSS scores to vulnerabilities provides a false sense of security.Their words
ALWAYS ignore any attempt that groups such as NIST/NVD that purport to assign things like CVSS scores to a vulnerability. Those numbers are false and give companies a "fake sense of security".
-
korrents.com
Any group attempting to assign severity scores to a Linux CVE without knowing the specific use case is lying.Their words
So any group that attempts to give a "severity score" to a Linux CVE is lying to you, UNLESS they know exactly your use case.
-
Their words
Personally, I think that filesystem corruption or data loss bug fixes should be considered a CVE fix, but until cve.org changes their policy, we can not assign CVEs for those types of fixes.
2 January
From one piece Linux kernel security work 2 beliefs, in the piece's order there
-
Their words
As history has shown us with Spectre and Meltdown, this "no embargo" policy does not always work well when working with problems that cross operating systems and hardware platforms, possibly requiring firmware or microcode updates.
-
Their words
This arrangement has allowed the kernel security team to remain independent and continue to operate across the different governments that the members operate in, and it looks to become the normal way project security teams work with the advent of the European Union's new CRA law coming into affect which places requirements on response time of companies that receive notice of potential security issues in their projects.
9 December 2025
From one piece Linux kernel version numbers 3 beliefs, in the piece's order there
-
korrents.com
It is not safe to compare kernel branches against each other using simple version number comparisons to track fixes.Their words
It is NOT safe to do a simple "if this version number is bigger than the previous one, then all fixes for it will be in the next release." You have to treat each kernel "branch" as a unique tree, and not compare them against each other in order to be able to properly track changes over time.
-
Their words
No kernel release should ever break any existing user's code or workflow.
-
korrents.com
All Linux kernel releases are stable and backwards compatible for userspace programs to all previous kernel releases.Their words
All releases are "stable" and backwards compatible for userspace programs to all previous kernel releases.
8 December 2025
-
korrents.com
The CVE JSON format is much more complicated than the format used by the kernel community to track CVE assignments.Their words
document a way that people can track CVE assignments on their own in a format that is, in my opinion, much simpler than attempting to rely on the CVE json format (and don't get me started on NVD...)
4 November 2025
17 August 2025
Nothing matches.
What is a korrent?
A korrent is a belief a person has stated in their own words: one sentence stating the claim, backed by a quote and a source, kept at korrents.com.
Under a name here, the quoted block is what they actually said. The korrent beneath it is the claim those words support, in korrents' wording — tap it to see the record, its source, and who else holds it.
Nobody here wrote their own korrents. They are compiled from public statements, and a person can change their mind, which is recorded too.
About the English under a post
Some people here publish in a language other than English. Where they do, this site shows a machine translation beneath the post, in this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the serif above is exactly what the person published, and it is what to quote them on. A translation can be wrong in ways that matter, especially about tone.
Only the post's own words are translated. A quoted post, a linked article and a belief on korrents.com are left in their original language.