Unpatched Linux kernel vulnerabilities accidentally emailed to public mailing list

A security flaw in the development process of the Linux kernel is currently allowing public access to unpatched fixes for vulnerabilities. It is recommended that system administrators patch with the fixed patches as soon as possible to avoid possible attacks against known vulnerabilities. This incident highlights the need to have tight internal control processes to keep the security of software distribution.

Kernel maintainers urge admins to patch after unpatched fixes sent to public

The heart of the problem is a failure in the patch distribution process that kernel maintainers rely on. A patch that contains unpatched vulnerabilities was mistakenly sent to a public mailing list instead of being restricted while in the review stage. This mistake circumvented normal security controls where sensitive code changes are normally isolated until released.

The material that has been affected is specific code changes to patch security vulnerabilities in the Linux kernel. The public mailing list was able to access the patches to these fixes before the maintainers could revoke the patches. This gives the opportunity for attackers to examine the vulnerabilities and possibly come up with an exploit before the fix is widely adopted.

We've seen some of these stability / balance issues before in other kernel updates, especially around support for legacy hardware. In the last Linux Kernel update, there was a focus on emulation for legacy CPU's as native support is starting to go away. This shows that there is an ongoing effort to keep compatibility going. This issue shows the importance to maintain a strict adherence to security protocol in the development of the kernel.

The team that develops the Linux kernel has admitted to the mistake and are trying to limit the effects of the exposure. For users that are relying on the kernel for critical infrastructure, you should check your patch levels and get the fixed versions once they are available. This just highlights how important tight internal controls are to keep the security of software projects intact.