€•õM      Œsphinx.addnodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”(Œtranslations”ŒLanguagesNode”“”)”}”(hhh]”(h Œpending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ	refdomain”Œstd”Œreftype”Œdoc”Œ	reftarget”Œ/translations/zh_CN/process/cve”Œmodname”NŒ	classname”NŒrefexplicit”ˆuŒtagname”hhhubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ/translations/zh_TW/process/cve”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ/translations/it_IT/process/cve”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ/translations/ja_JP/process/cve”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ/translations/ko_KR/process/cve”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ/translations/sp_SP/process/cve”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h
hhŒ	_document”hŒsource”NŒline”NubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒCVEs”h]”hŒCVEs”…””}”(hh¨hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hh£hžhhŸŒ9/var/lib/git/docbuild/linux/Documentation/process/cve.rst”h KubhŒ	paragraph”“”)”}”(hX°  Common Vulnerabilities and Exposure (CVEÂ®) numbers were developed as an
unambiguous way to identify, define, and catalog publicly disclosed
security vulnerabilities.  Over time, their usefulness has declined with
regards to the kernel project, and CVE numbers were very often assigned
in inappropriate ways and for inappropriate reasons.  Because of this,
the kernel development community has tended to avoid them.  However, the
combination of continuing pressure to assign CVEs and other forms of
security identifiers, and ongoing abuses by individuals and companies
outside of the kernel community has made it clear that the kernel
community should have control over those assignments.”h]”hX°  Common Vulnerabilities and Exposure (CVEÂ®) numbers were developed as an
unambiguous way to identify, define, and catalog publicly disclosed
security vulnerabilities.  Over time, their usefulness has declined with
regards to the kernel project, and CVE numbers were very often assigned
in inappropriate ways and for inappropriate reasons.  Because of this,
the kernel development community has tended to avoid them.  However, the
combination of continuing pressure to assign CVEs and other forms of
security identifiers, and ongoing abuses by individuals and companies
outside of the kernel community has made it clear that the kernel
community should have control over those assignments.”…””}”(hh¹hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khh£hžhubh¸)”}”(hŒìThe Linux kernel developer team does have the ability to assign CVEs for
potential Linux kernel security issues.  This assignment is independent
of the :doc:`normal Linux kernel security bug reporting
process<../process/security-bugs>`.”h]”(hŒ˜The Linux kernel developer team does have the ability to assign CVEs for
potential Linux kernel security issues.  This assignment is independent
of the ”…””}”(hhÇhžhhŸNh Nubh)”}”(hŒS:doc:`normal Linux kernel security bug reporting
process<../process/security-bugs>`”h]”hŒinline”“”)”}”(hhÑh]”hŒ2normal Linux kernel security bug reporting
process”…””}”(hhÕhžhhŸNh Nubah}”(h]”h ]”(Œxref”Œstd”Œstd-doc”eh"]”h$]”h&]”uh1hÓhhÏubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”Œprocess/cve”Œ	refdomain”hàŒreftype”Œdoc”Œrefexplicit”ˆŒrefwarn”ˆŒ	reftarget”Œ../process/security-bugs”uh1hhŸh¶h KhhÇubhŒ.”…””}”(hhÇhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khh£hžhubh¸)”}”(hX"  A list of all assigned CVEs for the Linux kernel can be found in the
archives of the linux-cve mailing list, as seen on
https://lore.kernel.org/linux-cve-announce/.  To get notice of the
assigned CVEs, please `subscribe
<https://subspace.kernel.org/subscribing.html>`_ to that mailing list.”h]”(hŒxA list of all assigned CVEs for the Linux kernel can be found in the
archives of the linux-cve mailing list, as seen on
”…””}”(hhþhžhhŸNh NubhŒ	reference”“”)”}”(hŒ+https://lore.kernel.org/linux-cve-announce/”h]”hŒ+https://lore.kernel.org/linux-cve-announce/”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”j
  uh1j  hhþubhŒ..  To get notice of the
assigned CVEs, please ”…””}”(hhþhžhhŸNh Nubj  )”}”(hŒ;`subscribe
<https://subspace.kernel.org/subscribing.html>`_”h]”hŒ	subscribe”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œ	subscribe”Œrefuri”Œ,https://subspace.kernel.org/subscribing.html”uh1j  hhþubhŒtarget”“”)”}”(hŒ/
<https://subspace.kernel.org/subscribing.html>”h]”h}”(h]”Œ	subscribe”ah ]”h"]”Œ	subscribe”ah$]”h&]”Œrefuri”j,  uh1j-  Œ
referenced”KhhþubhŒ to that mailing list.”…””}”(hhþhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Khh£hžhubh¢)”}”(hhh]”(h§)”}”(hŒProcess”h]”hŒProcess”…””}”(hjJ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hjG  hžhhŸh¶h Kubh¸)”}”(hXL  As part of the normal stable release process, kernel changes that are
potentially security issues are identified by the developers responsible
for CVE number assignments and have CVE numbers automatically assigned
to them.  These assignments are published on the linux-cve-announce
mailing list as announcements on a frequent basis.”h]”hXL  As part of the normal stable release process, kernel changes that are
potentially security issues are identified by the developers responsible
for CVE number assignments and have CVE numbers automatically assigned
to them.  These assignments are published on the linux-cve-announce
mailing list as announcements on a frequent basis.”…””}”(hjX  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KhjG  hžhubh¸)”}”(hX°  Note, due to the layer at which the Linux kernel is in a system, almost
any bug might be exploitable to compromise the security of the kernel,
but the possibility of exploitation is often not evident when the bug is
fixed.  Because of this, the CVE assignment team is overly cautious and
assign CVE numbers to any bugfix that they identify.  This
explains the seemingly large number of CVEs that are issued by the Linux
kernel team.”h]”hX°  Note, due to the layer at which the Linux kernel is in a system, almost
any bug might be exploitable to compromise the security of the kernel,
but the possibility of exploitation is often not evident when the bug is
fixed.  Because of this, the CVE assignment team is overly cautious and
assign CVE numbers to any bugfix that they identify.  This
explains the seemingly large number of CVEs that are issued by the Linux
kernel team.”…””}”(hjf  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K$hjG  hžhubh¸)”}”(hXô  If the CVE assignment team misses a specific fix that any user feels
should have a CVE assigned to it, please email them at <cve@kernel.org>
and the team there will work with you on it.  Note that no potential
security issues should be sent to this alias, it is ONLY for assignment
of CVEs for fixes that are already in released kernel trees.  If you
feel you have found an unfixed security issue, please follow the
:doc:`normal Linux kernel security bug reporting
process<../process/security-bugs>`.”h]”(hŒ}If the CVE assignment team misses a specific fix that any user feels
should have a CVE assigned to it, please email them at <”…””}”(hjt  hžhhŸNh Nubj  )”}”(hŒcve@kernel.org”h]”hŒcve@kernel.org”…””}”(hj|  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”Œmailto:cve@kernel.org”uh1j  hjt  ubhX  >
and the team there will work with you on it.  Note that no potential
security issues should be sent to this alias, it is ONLY for assignment
of CVEs for fixes that are already in released kernel trees.  If you
feel you have found an unfixed security issue, please follow the
”…””}”(hjt  hžhhŸNh Nubh)”}”(hŒS:doc:`normal Linux kernel security bug reporting
process<../process/security-bugs>`”h]”hÔ)”}”(hj’  h]”hŒ2normal Linux kernel security bug reporting
process”…””}”(hj”  hžhhŸNh Nubah}”(h]”h ]”(hßŒstd”Œstd-doc”eh"]”h$]”h&]”uh1hÓhj  ubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”hìŒ	refdomain”jž  Œreftype”Œdoc”Œrefexplicit”ˆŒrefwarn”ˆhòŒ../process/security-bugs”uh1hhŸh¶h K,hjt  ubhŒ.”…””}”(hjt  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K,hjG  hžhubh¸)”}”(hXç  No CVEs will be automatically assigned for unfixed security issues in
the Linux kernel; assignment will only automatically happen after a fix
is available and applied to a stable kernel tree, and it will be tracked
that way by the git commit id of the original fix.  If anyone wishes to
have a CVE assigned before an issue is resolved with a commit, please
contact the kernel CVE assignment team at <cve@kernel.org> to get an
identifier assigned from their batch of reserved identifiers.”h]”(hX  No CVEs will be automatically assigned for unfixed security issues in
the Linux kernel; assignment will only automatically happen after a fix
is available and applied to a stable kernel tree, and it will be tracked
that way by the git commit id of the original fix.  If anyone wishes to
have a CVE assigned before an issue is resolved with a commit, please
contact the kernel CVE assignment team at <”…””}”(hjº  hžhhŸNh Nubj  )”}”(hŒcve@kernel.org”h]”hŒcve@kernel.org”…””}”(hjÂ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”Œmailto:cve@kernel.org”uh1j  hjº  ubhŒI> to get an
identifier assigned from their batch of reserved identifiers.”…””}”(hjº  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K5hjG  hžhubh¸)”}”(hŒùNo CVEs will be assigned for any issue found in a version of the kernel
that is not currently being actively supported by the Stable/LTS kernel
team.  A list of the currently supported kernel branches can be found at
https://kernel.org/releases.html”h]”(hŒÙNo CVEs will be assigned for any issue found in a version of the kernel
that is not currently being actively supported by the Stable/LTS kernel
team.  A list of the currently supported kernel branches can be found at
”…””}”(hjÜ  hžhhŸNh Nubj  )”}”(hŒ https://kernel.org/releases.html”h]”hŒ https://kernel.org/releases.html”…””}”(hjä  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”jæ  uh1j  hjÜ  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h K=hjG  hžhubeh}”(h]”Œprocess”ah ]”h"]”Œprocess”ah$]”h&]”uh1h¡hh£hžhhŸh¶h Kubh¢)”}”(hhh]”(h§)”}”(hŒDisputes of assigned CVEs”h]”hŒDisputes of assigned CVEs”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hj  hžhhŸh¶h KCubh¸)”}”(hXc  The authority to dispute or modify an assigned CVE for a specific kernel
change lies solely with the maintainers of the relevant subsystem
affected.  This principle ensures a high degree of accuracy and
accountability in vulnerability reporting.  Only those individuals with
deep expertise and intimate knowledge of the subsystem can effectively
assess the validity and scope of a reported vulnerability and determine
its appropriate CVE designation.  Any attempt to modify or dispute a CVE
outside of this designated authority could lead to confusion, inaccurate
reporting, and ultimately, compromised systems.”h]”hXc  The authority to dispute or modify an assigned CVE for a specific kernel
change lies solely with the maintainers of the relevant subsystem
affected.  This principle ensures a high degree of accuracy and
accountability in vulnerability reporting.  Only those individuals with
deep expertise and intimate knowledge of the subsystem can effectively
assess the validity and scope of a reported vulnerability and determine
its appropriate CVE designation.  Any attempt to modify or dispute a CVE
outside of this designated authority could lead to confusion, inaccurate
reporting, and ultimately, compromised systems.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KEhj  hžhubeh}”(h]”Œdisputes-of-assigned-cves”ah ]”h"]”Œdisputes of assigned cves”ah$]”h&]”uh1h¡hh£hžhhŸh¶h KCubh¢)”}”(hhh]”(h§)”}”(hŒInvalid CVEs”h]”hŒInvalid CVEs”…””}”(hj+  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hj(  hžhhŸh¶h KPubh¸)”}”(hX…  If a security issue is found in a Linux kernel that is only supported by
a Linux distribution due to the changes that have been made by that
distribution, or due to the distribution supporting a kernel version
that is no longer one of the kernel.org supported releases, then a CVE
can not be assigned by the Linux kernel CVE team, and must be asked for
from that Linux distribution itself.”h]”hX…  If a security issue is found in a Linux kernel that is only supported by
a Linux distribution due to the changes that have been made by that
distribution, or due to the distribution supporting a kernel version
that is no longer one of the kernel.org supported releases, then a CVE
can not be assigned by the Linux kernel CVE team, and must be asked for
from that Linux distribution itself.”…””}”(hj9  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KRhj(  hžhubh¸)”}”(hXP  Any CVE that is assigned against the Linux kernel for an actively
supported kernel version, by any group other than the kernel assignment
CVE team should not be treated as a valid CVE.  Please notify the
kernel CVE assignment team at <cve@kernel.org> so that they can work to
invalidate such entries through the CNA remediation process.”h]”(hŒëAny CVE that is assigned against the Linux kernel for an actively
supported kernel version, by any group other than the kernel assignment
CVE team should not be treated as a valid CVE.  Please notify the
kernel CVE assignment team at <”…””}”(hjG  hžhhŸNh Nubj  )”}”(hŒcve@kernel.org”h]”hŒcve@kernel.org”…””}”(hjO  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”Œmailto:cve@kernel.org”uh1j  hjG  ubhŒW> so that they can work to
invalidate such entries through the CNA remediation process.”…””}”(hjG  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h KYhj(  hžhubeh}”(h]”Œinvalid-cves”ah ]”h"]”Œinvalid cves”ah$]”h&]”uh1h¡hh£hžhhŸh¶h KPubh¢)”}”(hhh]”(h§)”}”(hŒApplicability of specific CVEs”h]”hŒApplicability of specific CVEs”…””}”(hjt  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¦hjq  hžhhŸh¶h K`ubh¸)”}”(hXY  As the Linux kernel can be used in many different ways, with many
different ways of accessing it by external users, or no access at all,
the applicability of any specific CVE is up to the user of Linux to
determine, it is not up to the CVE assignment team.  Please do not
contact us to attempt to determine the applicability of any specific
CVE.”h]”hXY  As the Linux kernel can be used in many different ways, with many
different ways of accessing it by external users, or no access at all,
the applicability of any specific CVE is up to the user of Linux to
determine, it is not up to the CVE assignment team.  Please do not
contact us to attempt to determine the applicability of any specific
CVE.”…””}”(hj‚  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Kbhjq  hžhubh¸)”}”(hŒÐAlso, as the source tree is so large, and any one system only uses a
small subset of the source tree, any users of Linux should be aware that
large numbers of assigned CVEs are not relevant for their systems.”h]”hŒÐAlso, as the source tree is so large, and any one system only uses a
small subset of the source tree, any users of Linux should be aware that
large numbers of assigned CVEs are not relevant for their systems.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Kihjq  hžhubh¸)”}”(hŒºIn short, we do not know your use case, and we do not know what portions
of the kernel that you use, so there is no way for us to determine if a
specific CVE is relevant for your system.”h]”hŒºIn short, we do not know your use case, and we do not know what portions
of the kernel that you use, so there is no way for us to determine if a
specific CVE is relevant for your system.”…””}”(hjž  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Kmhjq  hžhubh¸)”}”(hX  As always, it is best to take all released kernel changes, as they are
tested together in a unified whole by many community members, and not as
individual cherry-picked changes.  Also note that for many bugs, the
solution to the overall problem is not found in a single change, but by
the sum of many fixes on top of each other.  Ideally CVEs will be
assigned to all fixes for all issues, but sometimes we will fail to
notice fixes, therefore assume that some changes without a CVE assigned
might be relevant to take.”h]”hX  As always, it is best to take all released kernel changes, as they are
tested together in a unified whole by many community members, and not as
individual cherry-picked changes.  Also note that for many bugs, the
solution to the overall problem is not found in a single change, but by
the sum of many fixes on top of each other.  Ideally CVEs will be
assigned to all fixes for all issues, but sometimes we will fail to
notice fixes, therefore assume that some changes without a CVE assigned
might be relevant to take.”…””}”(hj¬  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h·hŸh¶h Kqhjq  hžhubeh}”(h]”Œapplicability-of-specific-cves”ah ]”h"]”Œapplicability of specific cves”ah$]”h&]”uh1h¡hh£hžhhŸh¶h K`ubeh}”(h]”Œcves”ah ]”h"]”Œcves”ah$]”h&]”uh1h¡hhhžhhŸh¶h Kubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h¶uh1hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(h¦NŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”Œentry”Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”jí  Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h¶Œ_destination”NŒ_config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒraw_enabled”KŒline_length_limit”M'Œpep_references”NŒpep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œimage_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”Œnameids”}”(jÇ  jÄ  j8  j5  jþ  jû  j%  j"  jn  jk  j¿  j¼  uŒ	nametypes”}”(jÇ  ‰j8  ˆjþ  ‰j%  ‰jn  ‰j¿  ‰uh}”(jÄ  h£j5  j/  jû  jG  j"  j  jk  j(  j¼  jq  uŒfootnote_refs”}”Œcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”Œ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œ
id_counter”Œcollections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”Œtransformer”NŒinclude_log”]”Œ
decoration”Nhžhub.