Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The Linux kernel’s security process is a maintainer-led route for assessing and fixing software vulnerabilities, with coordinated disclosure after a robust fix is ready. A useful report identifies the affected code and exact kernel version or commit, explains the security impact, and goes by email to the relevant subsystem maintainers. CVE assignment is separate, and cross-platform hardware vulnerabilities use a different coordination process.
What counts as a kernel security issue?
The kernel threat model sets the boundary: a report needs to demonstrate a security consequence within the kernel’s scope and show that an actively maintained kernel version is affected. A correctness bug is not automatically a security vulnerability; without a credible security impact, it belongs in the normal bug-reporting channels. See the Linux kernel threat model.
As an Amazon Associate I earn from qualifying purchases.
For a candidate vulnerability, establish what code is affected and whether the issue remains present in a current development or supported stable version. This matters because reports can describe defects already fixed. “Latest” alone is not a useful version identifier: provide an exact release, commit, or affected version range.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to report a software vulnerability
1. Gather evidence maintainers can act on
Describe what happens, why it creates a security risk, how to reproduce it, and which versions and configurations you tested. Include relevant configuration details and a proposed fix if you have one. Be ready to answer follow-up questions or perform additional checks; active collaboration helps maintainers investigate and remediate the issue.
#1 Best Overall
2. Email the code owners
Send a plain-text report by email to the maintainers of the affected subsystem. The project identifies those maintainers as the most effective first recipients, with the Linux kernel security team copied where appropriate. If the message has two or fewer recipients, the security-bugs guidance says to copy the security team so it can help route the report or assist the maintainers. The current instructions are in the kernel’s Security bugs documentation.
Keep a potentially sensitive report off public mailing lists during initial coordination unless there is a sound reason to consider the issue already public or trivial to discover. The documentation is explicit: “The security list is not a disclosure channel.” Send enough information in the message itself that it can be understood without relying on attachments or material available only online.
Rank #2
3. Work with maintainers on a robust fix
Stay available while maintainers and the security team triage the report and prepare a fix. The goal is a robust correction, not merely a quick patch that leaves the underlying security issue unresolved. The disclosure schedule depends on whether the issue is already public and whether a limited delay is needed for rollout logistics.
When does the fix become public?
According to the security-bugs guidance, publicly known issues are released immediately once fixed. For a privately reported issue, the project prefers release as soon as a robust fix is available. A reporter or affected party can request a short delay for coordination: up to seven calendar days from the start of release, or exceptionally up to fourteen days when the issue’s criticality justifies the extension. These are limits for practical coordination, not an open-ended embargo. The guidance is described in the security reporting process.
Why a CVE is not the first step
A CVE is a public vulnerability identifier, not the intake route for an unfixed kernel bug. The kernel’s CVE assignment process is independent of ordinary security reporting. Its assignment team identifies potentially security-related changes through the stable release process; automatic assignment is tied to a fix being available and applied to a stable kernel tree. Announcements go through the linux-cve-announce mailing list. An unfixed issue should first be reported through the security-bug process, rather than waiting for a CVE number.
Issues specific to distribution changes, or to upstream versions that are no longer supported, may be the distribution’s responsibility. The project’s CVE documentation explains the distinction and process.
Hardware vulnerabilities follow a different route
A flaw in hardware that affects multiple operating systems can require coordination among kernel responders, operating-system vendors, distributions, silicon vendors, hardware integrators, and parties preparing firmware or microcode mitigations. The kernel has a separate process for embargoed hardware issues; it is not the route for a pure software bug in kernel code.
For hardware issues, involved parties coordinate the public release time, and mitigations are published to the relevant kernel trees when the embargo ends. The hardware process does not assign CVEs as part of its development work. Consult the project’s embargoed hardware issues guidance to determine whether this route applies.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which process applies?
| Process | Purpose | Initial route | Participants | Public timing |
|---|---|---|---|---|
| Software kernel vulnerability | Triage and fix a security defect in kernel code | Affected subsystem maintainers; copy the kernel security team as appropriate | Reporter, maintainers, kernel security team | Known issues are released when fixed; a limited coordination delay may apply to privately reported issues |
| Embargoed hardware issue | Coordinate a hardware mitigation across affected platforms | Separate hardware security team | Kernel responders and relevant vendors, distributions, and hardware parties | Involved parties coordinate release for the end of the embargo |
| CVE assignment | Provide a public vulnerability identifier | Separate CVE assignment process, associated with stable fixes | Kernel CVE assignment team and stable release process | Assignments are announced through the linux-cve-announce mailing list |
The boundaries and timing above are described across the kernel’s security-bugs, threat-model, CVE, and hardware-issue documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
