€•Ùó      Œsphinx.addnodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”(Œtranslations”ŒLanguagesNode”“”)”}”(hhh]”(h Œpending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ	refdomain”Œstd”Œreftype”Œdoc”Œ	reftarget”Œ)/translations/zh_CN/process/security-bugs”Œmodname”NŒ	classname”NŒrefexplicit”ˆuŒtagname”hhhubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ)/translations/zh_TW/process/security-bugs”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ)/translations/it_IT/process/security-bugs”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ)/translations/ja_JP/process/security-bugs”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ)/translations/ko_KR/process/security-bugs”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒPortuguese (Brazilian)”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ)/translations/pt_BR/process/security-bugs”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒSpanish”…””}”hh–sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ)/translations/sp_SP/process/security-bugs”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h
hhŒ	_document”hŒsource”NŒline”NubhŒtarget”“”)”}”(hŒ.. _securitybugs:”h]”h}”(h]”h ]”h"]”h$]”h&]”Œrefid”Œsecuritybugs”uh1hµh´Khhh²hh³ŒC/var/lib/git/docbuild/linux/Documentation/process/security-bugs.rst”ubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒSecurity bugs”h]”hŒSecurity bugs”…””}”(hhËh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhhÆh²hh³hÃh´KubhŒ	paragraph”“”)”}”(hŒ¬Linux kernel developers take security very seriously.  As such, we'd
like to know when a security bug is found so that it can be fixed and
disclosed as quickly as possible.”h]”hŒ®Linux kernel developers take security very seriously.  As such, weâ€™d
like to know when a security bug is found so that it can be fixed and
disclosed as quickly as possible.”…””}”(hhÛh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KhhÆh²hubhÅ)”}”(hhh]”(hÊ)”}”(hŒPreparing your report”h]”hŒPreparing your report”…””}”(hhìh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhhéh²hh³hÃh´KubhÚ)”}”(hX‰  Like with any bug report, a security bug report requires a lot of analysis work
from the developers, so the more information you can share about the issue, the
better.  Please review the procedure outlined in
Documentation/admin-guide/reporting-issues.rst if you are unclear about what
information is helpful.  The following information are absolutely necessary in
**any** security bug report:”h]”(hXm  Like with any bug report, a security bug report requires a lot of analysis work
from the developers, so the more information you can share about the issue, the
better.  Please review the procedure outlined in
Documentation/admin-guide/reporting-issues.rst if you are unclear about what
information is helpful.  The following information are absolutely necessary in
”…””}”(hhúh²hh³Nh´NubhŒstrong”“”)”}”(hŒ**any**”h]”hŒany”…””}”(hj  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hhúubhŒ security bug report:”…””}”(hhúh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Khhéh²hubhŒblock_quote”“”)”}”(hXn  * **affected kernel version range**: with no version indication, your report
  will not be processed.  A significant part of reports are for bugs that
  have already been fixed, so it is extremely important that vulnerabilities
  are verified on recent versions (development tree or latest stable
  version), at least by verifying that the code has not changed since the
  version where it was detected.

* **description of the problem**: a detailed description of the problem, with
  traces showing its manifestation, and why you consider that the observed
  behavior as a problem in the kernel, is necessary.

* **reproducer**: developers will need to be able to reproduce the problem to
  consider a fix as effective.  This includes both a way to trigger the issue
  and a way to confirm it happens.  A reproducer with low complexity
  dependencies will be needed (source code, shell script, sequence of
  instructions, file-system image etc).  Binary-only executables are not
  accepted.  Working exploits are extremely helpful and will not be released
  without consent from the reporter, unless they are already public.  By
  definition if an issue cannot be reproduced, it is not exploitable, thus it
  is not a security bug.

* **conditions**: if the bug depends on certain configuration options,
  sysctls, permissions, timing, code modifications etc, these should be
  indicated.
”h]”hŒbullet_list”“”)”}”(hhh]”(hŒ	list_item”“”)”}”(hXˆ  **affected kernel version range**: with no version indication, your report
will not be processed.  A significant part of reports are for bugs that
have already been fixed, so it is extremely important that vulnerabilities
are verified on recent versions (development tree or latest stable
version), at least by verifying that the code has not changed since the
version where it was detected.
”h]”hÚ)”}”(hX‡  **affected kernel version range**: with no version indication, your report
will not be processed.  A significant part of reports are for bugs that
have already been fixed, so it is extremely important that vulnerabilities
are verified on recent versions (development tree or latest stable
version), at least by verifying that the code has not changed since the
version where it was detected.”h]”(j  )”}”(hŒ!**affected kernel version range**”h]”hŒaffected kernel version range”…””}”(hj1  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hj-  ubhXf  : with no version indication, your report
will not be processed.  A significant part of reports are for bugs that
have already been fixed, so it is extremely important that vulnerabilities
are verified on recent versions (development tree or latest stable
version), at least by verifying that the code has not changed since the
version where it was detected.”…””}”(hj-  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Khj)  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hj$  ubj(  )”}”(hŒÈ**description of the problem**: a detailed description of the problem, with
traces showing its manifestation, and why you consider that the observed
behavior as a problem in the kernel, is necessary.
”h]”hÚ)”}”(hŒÇ**description of the problem**: a detailed description of the problem, with
traces showing its manifestation, and why you consider that the observed
behavior as a problem in the kernel, is necessary.”h]”(j  )”}”(hŒ**description of the problem**”h]”hŒdescription of the problem”…””}”(hjW  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjS  ubhŒ©: a detailed description of the problem, with
traces showing its manifestation, and why you consider that the observed
behavior as a problem in the kernel, is necessary.”…””}”(hjS  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KhjO  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hj$  ubj(  )”}”(hX[  **reproducer**: developers will need to be able to reproduce the problem to
consider a fix as effective.  This includes both a way to trigger the issue
and a way to confirm it happens.  A reproducer with low complexity
dependencies will be needed (source code, shell script, sequence of
instructions, file-system image etc).  Binary-only executables are not
accepted.  Working exploits are extremely helpful and will not be released
without consent from the reporter, unless they are already public.  By
definition if an issue cannot be reproduced, it is not exploitable, thus it
is not a security bug.
”h]”hÚ)”}”(hXZ  **reproducer**: developers will need to be able to reproduce the problem to
consider a fix as effective.  This includes both a way to trigger the issue
and a way to confirm it happens.  A reproducer with low complexity
dependencies will be needed (source code, shell script, sequence of
instructions, file-system image etc).  Binary-only executables are not
accepted.  Working exploits are extremely helpful and will not be released
without consent from the reporter, unless they are already public.  By
definition if an issue cannot be reproduced, it is not exploitable, thus it
is not a security bug.”h]”(j  )”}”(hŒ**reproducer**”h]”hŒ
reproducer”…””}”(hj}  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjy  ubhXL  : developers will need to be able to reproduce the problem to
consider a fix as effective.  This includes both a way to trigger the issue
and a way to confirm it happens.  A reproducer with low complexity
dependencies will be needed (source code, shell script, sequence of
instructions, file-system image etc).  Binary-only executables are not
accepted.  Working exploits are extremely helpful and will not be released
without consent from the reporter, unless they are already public.  By
definition if an issue cannot be reproduced, it is not exploitable, thus it
is not a security bug.”…””}”(hjy  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Khju  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hj$  ubj(  )”}”(hŒ–**conditions**: if the bug depends on certain configuration options,
sysctls, permissions, timing, code modifications etc, these should be
indicated.
”h]”hÚ)”}”(hŒ•**conditions**: if the bug depends on certain configuration options,
sysctls, permissions, timing, code modifications etc, these should be
indicated.”h]”(j  )”}”(hŒ**conditions**”h]”hŒ
conditions”…””}”(hj£  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjŸ  ubhŒ‡: if the bug depends on certain configuration options,
sysctls, permissions, timing, code modifications etc, these should be
indicated.”…””}”(hjŸ  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K)hj›  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hj$  ubeh}”(h]”h ]”h"]”h$]”h&]”Œbullet”Œ*”uh1j"  h³hÃh´Khj  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j  h³hÃh´Khhéh²hubhÚ)”}”(hŒ<In addition, the following information are highly desirable:”h]”hŒ<In addition, the following information are highly desirable:”…””}”(hjÏ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K-hhéh²hubj  )”}”(hXI  * **suspected location of the bug**: the file names and functions where the
  bug is suspected to be present are very important, at least to help forward
  the report to the appropriate maintainers.  When not possible (for example,
  "system freezes each time I run this command"), the security team will help
  identify the source of the bug.

* **a proposed fix**: bug reporters who have analyzed the cause of a bug in
  the source code almost always have an accurate idea on how to fix it,
  because they spent a long time studying it and its implications.  Proposing
  a tested fix will save maintainers a lot of time, even if the fix ends up
  not being the right one, because it helps understand the bug.  When
  proposing a tested fix, please always format it in a way that can be
  immediately merged (see Documentation/process/submitting-patches.rst).
  This will save some back-and-forth exchanges if it is accepted, and you
  will be credited for finding and fixing this issue.  Note that in this case
  only a ``Signed-off-by:`` tag is needed, without ``Reported-by:`` when the
  reporter and author are the same.

* **mitigations**: very often during a bug analysis, some ways of mitigating
  the issue appear. It is useful to share them, as they can be helpful to
  keep end users protected during the time it takes them to apply the fix.
”h]”j#  )”}”(hhh]”(j(  )”}”(hXN  **suspected location of the bug**: the file names and functions where the
bug is suspected to be present are very important, at least to help forward
the report to the appropriate maintainers.  When not possible (for example,
"system freezes each time I run this command"), the security team will help
identify the source of the bug.
”h]”hÚ)”}”(hXM  **suspected location of the bug**: the file names and functions where the
bug is suspected to be present are very important, at least to help forward
the report to the appropriate maintainers.  When not possible (for example,
"system freezes each time I run this command"), the security team will help
identify the source of the bug.”h]”(j  )”}”(hŒ!**suspected location of the bug**”h]”hŒsuspected location of the bug”…””}”(hjì  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjè  ubhX0  : the file names and functions where the
bug is suspected to be present are very important, at least to help forward
the report to the appropriate maintainers.  When not possible (for example,
â€œsystem freezes each time I run this commandâ€), the security team will help
identify the source of the bug.”…””}”(hjè  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K/hjä  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hjá  ubj(  )”}”(hX÷  **a proposed fix**: bug reporters who have analyzed the cause of a bug in
the source code almost always have an accurate idea on how to fix it,
because they spent a long time studying it and its implications.  Proposing
a tested fix will save maintainers a lot of time, even if the fix ends up
not being the right one, because it helps understand the bug.  When
proposing a tested fix, please always format it in a way that can be
immediately merged (see Documentation/process/submitting-patches.rst).
This will save some back-and-forth exchanges if it is accepted, and you
will be credited for finding and fixing this issue.  Note that in this case
only a ``Signed-off-by:`` tag is needed, without ``Reported-by:`` when the
reporter and author are the same.
”h]”hÚ)”}”(hXö  **a proposed fix**: bug reporters who have analyzed the cause of a bug in
the source code almost always have an accurate idea on how to fix it,
because they spent a long time studying it and its implications.  Proposing
a tested fix will save maintainers a lot of time, even if the fix ends up
not being the right one, because it helps understand the bug.  When
proposing a tested fix, please always format it in a way that can be
immediately merged (see Documentation/process/submitting-patches.rst).
This will save some back-and-forth exchanges if it is accepted, and you
will be credited for finding and fixing this issue.  Note that in this case
only a ``Signed-off-by:`` tag is needed, without ``Reported-by:`` when the
reporter and author are the same.”h]”(j  )”}”(hŒ**a proposed fix**”h]”hŒa proposed fix”…””}”(hj  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hj  ubhX  : bug reporters who have analyzed the cause of a bug in
the source code almost always have an accurate idea on how to fix it,
because they spent a long time studying it and its implications.  Proposing
a tested fix will save maintainers a lot of time, even if the fix ends up
not being the right one, because it helps understand the bug.  When
proposing a tested fix, please always format it in a way that can be
immediately merged (see Documentation/process/submitting-patches.rst).
This will save some back-and-forth exchanges if it is accepted, and you
will be credited for finding and fixing this issue.  Note that in this case
only a ”…””}”(hj  h²hh³Nh´NubhŒliteral”“”)”}”(hŒ``Signed-off-by:``”h]”hŒSigned-off-by:”…””}”(hj&  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j$  hj  ubhŒ tag is needed, without ”…””}”(hj  h²hh³Nh´Nubj%  )”}”(hŒ``Reported-by:``”h]”hŒReported-by:”…””}”(hj8  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j$  hj  ubhŒ+ when the
reporter and author are the same.”…””}”(hj  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K5hj
  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hjá  ubj(  )”}”(hŒÜ**mitigations**: very often during a bug analysis, some ways of mitigating
the issue appear. It is useful to share them, as they can be helpful to
keep end users protected during the time it takes them to apply the fix.
”h]”hÚ)”}”(hŒÛ**mitigations**: very often during a bug analysis, some ways of mitigating
the issue appear. It is useful to share them, as they can be helpful to
keep end users protected during the time it takes them to apply the fix.”h]”(j  )”}”(hŒ**mitigations**”h]”hŒmitigations”…””}”(hj^  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjZ  ubhŒÌ: very often during a bug analysis, some ways of mitigating
the issue appear. It is useful to share them, as they can be helpful to
keep end users protected during the time it takes them to apply the fix.”…””}”(hjZ  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KAhjV  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hjá  ubeh}”(h]”h ]”h"]”h$]”h&]”jÇ  jÈ  uh1j"  h³hÃh´K/hjÝ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j  h³hÃh´K/hhéh²hubeh}”(h]”Œpreparing-your-report”ah ]”h"]”Œpreparing your report”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´KubhÅ)”}”(hhh]”(hÊ)”}”(hŒ What qualifies as a security bug”h]”hŒ What qualifies as a security bug”…””}”(hj“  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhj  h²hh³hÃh´KFubhÚ)”}”(hXN  It is important that most bugs are handled publicly so as to involve the widest
possible audience and find the best solution.  By nature, bugs that are handled
in closed discussions between a small set of participants are less likely to
produce the best possible fix (e.g., risk of missing valid use cases, limited
testing abilities).”h]”hXN  It is important that most bugs are handled publicly so as to involve the widest
possible audience and find the best solution.  By nature, bugs that are handled
in closed discussions between a small set of participants are less likely to
produce the best possible fix (e.g., risk of missing valid use cases, limited
testing abilities).”…””}”(hj¡  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KHhj  h²hubhÚ)”}”(hXˆ  It turns out that the majority of the bugs reported via the security team are
just regular bugs that have been improperly qualified as security bugs due to
a lack of awareness of the Linux kernel's threat model, as described in
Documentation/process/threat-model.rst, and ought to have been sent through
the normal channels described in Documentation/admin-guide/reporting-issues.rst
instead.”h]”hXŠ  It turns out that the majority of the bugs reported via the security team are
just regular bugs that have been improperly qualified as security bugs due to
a lack of awareness of the Linux kernelâ€™s threat model, as described in
Documentation/process/threat-model.rst, and ought to have been sent through
the normal channels described in Documentation/admin-guide/reporting-issues.rst
instead.”…””}”(hj¯  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KNhj  h²hubhÚ)”}”(hXE  The security list exists for urgent bugs that grant an attacker a capability
they are not supposed to have on a correctly configured production system, and
can be easily exploited, representing an imminent threat to many users.  Before
reporting, consider whether the issue actually crosses a trust boundary on such
a system.”h]”hXE  The security list exists for urgent bugs that grant an attacker a capability
they are not supposed to have on a correctly configured production system, and
can be easily exploited, representing an imminent threat to many users.  Before
reporting, consider whether the issue actually crosses a trust boundary on such
a system.”…””}”(hj½  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KUhj  h²hubhÚ)”}”(hXÞ  **If you resorted to AI assistance to identify a bug, you must treat it as
public**. While you may have valid reasons to believe it is not, the security
team's experience shows that bugs discovered this way systematically surface
simultaneously across multiple researchers, often on the same day. In this
case, do not publicly share a reproducer, as this could cause unintended harm;
just mention that one is available and maintainers might ask for it privately
if they need it.”h]”(j  )”}”(hŒS**If you resorted to AI assistance to identify a bug, you must treat it as
public**”h]”hŒOIf you resorted to AI assistance to identify a bug, you must treat it as
public”…””}”(hjÏ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjË  ubhX  . While you may have valid reasons to believe it is not, the security
teamâ€™s experience shows that bugs discovered this way systematically surface
simultaneously across multiple researchers, often on the same day. In this
case, do not publicly share a reproducer, as this could cause unintended harm;
just mention that one is available and maintainers might ask for it privately
if they need it.”…””}”(hjË  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K[hj  h²hubhÚ)”}”(hX<  If you are unsure whether an issue qualifies, err on the side of reporting
privately: the security team would rather triage a borderline report than miss
a real vulnerability.  Reporting ordinary bugs to the security list, however,
does not make them move faster and consumes triage capacity that other reports
need.”h]”hX<  If you are unsure whether an issue qualifies, err on the side of reporting
privately: the security team would rather triage a borderline report than miss
a real vulnerability.  Reporting ordinary bugs to the security list, however,
does not make them move faster and consumes triage capacity that other reports
need.”…””}”(hjç  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Kchj  h²hubeh}”(h]”Œ what-qualifies-as-a-security-bug”ah ]”h"]”Œ what qualifies as a security bug”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´KFubhÅ)”}”(hhh]”(hÊ)”}”(hŒIdentifying contacts”h]”hŒIdentifying contacts”…””}”(hj   h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjý  h²hh³hÃh´KjubhÚ)”}”(hX¤  The most effective way to report a security bug is to send it directly to the
affected subsystem's maintainers and Cc: the Linux kernel security team.  Do
not send it to a public list at this stage, unless you have good reasons to
consider the issue as being public or trivial to discover (e.g. result of a
widely available automated vulnerability scanning tool that can be repeated by
anyone, or use of AI-based tools).”h]”hX¦  The most effective way to report a security bug is to send it directly to the
affected subsystemâ€™s maintainers and Cc: the Linux kernel security team.  Do
not send it to a public list at this stage, unless you have good reasons to
consider the issue as being public or trivial to discover (e.g. result of a
widely available automated vulnerability scanning tool that can be repeated by
anyone, or use of AI-based tools).”…””}”(hj  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Klhjý  h²hubhÚ)”}”(hXÑ  If you're sending a report for issues affecting multiple parts in the kernel,
even if they're fairly similar issues, please send individual messages (think
that maintainers will not all work on the issues at the same time). The only
exception is when an issue concerns closely related parts maintained by the
exact same subset of maintainers, and these parts are expected to be fixed all
at once by the same commit, then it may be acceptable to report them at once.”h]”hXÕ  If youâ€™re sending a report for issues affecting multiple parts in the kernel,
even if theyâ€™re fairly similar issues, please send individual messages (think
that maintainers will not all work on the issues at the same time). The only
exception is when an issue concerns closely related parts maintained by the
exact same subset of maintainers, and these parts are expected to be fixed all
at once by the same commit, then it may be acceptable to report them at once.”…””}”(hj  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Kshjý  h²hubhÚ)”}”(hXý  One difficulty for most first-time reporters is to figure the right list of
recipients to send a report to.  In the Linux kernel, all official maintainers
are trusted, so the consequences of accidentally including the wrong maintainer
are essentially a bit more noise for that person, i.e. nothing dramatic.  As
such, a suitable method to figure the list of maintainers (which kernel
security officers use) is to rely on the get_maintainer.pl script, tuned to
only report maintainers.  This script, when passed a file name, will look for
its path in the MAINTAINERS file to figure a hierarchical list of relevant
maintainers.  Calling it a first time with the finest level of filtering will
most of the time return a short list of this specific file's maintainers::”h]”hXþ  One difficulty for most first-time reporters is to figure the right list of
recipients to send a report to.  In the Linux kernel, all official maintainers
are trusted, so the consequences of accidentally including the wrong maintainer
are essentially a bit more noise for that person, i.e. nothing dramatic.  As
such, a suitable method to figure the list of maintainers (which kernel
security officers use) is to rely on the get_maintainer.pl script, tuned to
only report maintainers.  This script, when passed a file name, will look for
its path in the MAINTAINERS file to figure a hierarchical list of relevant
maintainers.  Calling it a first time with the finest level of filtering will
most of the time return a short list of this specific fileâ€™s maintainers:”…””}”(hj*  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Kzhjý  h²hubhŒliteral_block”“”)”}”(hŒÍ$ ./scripts/get_maintainer.pl --no-l --no-r --pattern-depth 1 \
  drivers/example.c
Developer One <dev1@example.com> (maintainer:example driver)
Developer Two <dev2@example.org> (maintainer:example driver)”h]”hŒÍ$ ./scripts/get_maintainer.pl --no-l --no-r --pattern-depth 1 \
  drivers/example.c
Developer One <dev1@example.com> (maintainer:example driver)
Developer Two <dev2@example.org> (maintainer:example driver)”…””}”hj:  sbah}”(h]”h ]”h"]”h$]”h&]”Œ	xml:space”Œpreserve”uh1j8  h³hÃh´K…hjý  h²hubhÚ)”}”(hŒ¹These two maintainers should then receive the message.  If the command does not
return anything, it means the affected file is part of a wider subsystem, so we
should be less specific::”h]”hŒ¸These two maintainers should then receive the message.  If the command does not
return anything, it means the affected file is part of a wider subsystem, so we
should be less specific:”…””}”(hjJ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KŠhjý  h²hubj9  )”}”(hXT  $ ./scripts/get_maintainer.pl --no-l --no-r drivers/example.c
Developer One <dev1@example.com> (maintainer:example subsystem)
Developer Two <dev2@example.org> (maintainer:example subsystem)
Developer Three <dev3@example.com> (maintainer:example subsystem [GENERAL])
Developer Four <dev4@example.org> (maintainer:example subsystem [GENERAL])”h]”hXT  $ ./scripts/get_maintainer.pl --no-l --no-r drivers/example.c
Developer One <dev1@example.com> (maintainer:example subsystem)
Developer Two <dev2@example.org> (maintainer:example subsystem)
Developer Three <dev3@example.com> (maintainer:example subsystem [GENERAL])
Developer Four <dev4@example.org> (maintainer:example subsystem [GENERAL])”…””}”hjX  sbah}”(h]”h ]”h"]”h$]”h&]”jH  jI  uh1j8  h³hÃh´KŽhjý  h²hubhÚ)”}”(hŒÞHere, picking the first, most specific ones, is sufficient.  When the list is
long, it is possible to produce a comma-delimited e-mail address list on a
single line suitable for use in the To: field of a mailer like this::”h]”hŒÝHere, picking the first, most specific ones, is sufficient.  When the list is
long, it is possible to produce a comma-delimited e-mail address list on a
single line suitable for use in the To: field of a mailer like this:”…””}”(hjf  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K”hjý  h²hubj9  )”}”(hŒÎ$ ./scripts/get_maintainer.pl --no-tree --no-l --no-r --no-n --m \
  --no-git-fallback --no-substatus --no-rolestats --no-multiline \
  --pattern-depth 1 drivers/example.c
dev1@example.com, dev2@example.org”h]”hŒÎ$ ./scripts/get_maintainer.pl --no-tree --no-l --no-r --no-n --m \
  --no-git-fallback --no-substatus --no-rolestats --no-multiline \
  --pattern-depth 1 drivers/example.c
dev1@example.com, dev2@example.org”…””}”hjt  sbah}”(h]”h ]”h"]”h$]”h&]”jH  jI  uh1j8  h³hÃh´K˜hjý  h²hubhÚ)”}”(hŒor this for the wider list::”h]”hŒor this for the wider list:”…””}”(hj‚  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Khjý  h²hubj9  )”}”(hŒà$ ./scripts/get_maintainer.pl --no-tree --no-l --no-r --no-n --m \
  --no-git-fallback --no-substatus --no-rolestats --no-multiline \
  drivers/example.c
dev1@example.com, dev2@example.org, dev3@example.com, dev4@example.org”h]”hŒà$ ./scripts/get_maintainer.pl --no-tree --no-l --no-r --no-n --m \
  --no-git-fallback --no-substatus --no-rolestats --no-multiline \
  drivers/example.c
dev1@example.com, dev2@example.org, dev3@example.com, dev4@example.org”…””}”hj  sbah}”(h]”h ]”h"]”h$]”h&]”jH  jI  uh1j8  h³hÃh´KŸhjý  h²hubhÚ)”}”(hXc  If at this point you're still facing difficulties spotting the right
maintainers, **and only in this case**, it's possible to send your report to
the Linux kernel security team only.  Your message will be triaged, and you
will receive instructions about whom to contact, if needed.  Your message may
equally be forwarded as-is to the relevant maintainers.”h]”(hŒTIf at this point youâ€™re still facing difficulties spotting the right
maintainers, ”…””}”(hjž  h²hh³Nh´Nubj  )”}”(hŒ**and only in this case**”h]”hŒand only in this case”…””}”(hj¦  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjž  ubhŒú, itâ€™s possible to send your report to
the Linux kernel security team only.  Your message will be triaged, and you
will receive instructions about whom to contact, if needed.  Your message may
equally be forwarded as-is to the relevant maintainers.”…””}”(hjž  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K¤hjý  h²hubeh}”(h]”Œidentifying-contacts”ah ]”h"]”Œidentifying contacts”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´KjubhÅ)”}”(hhh]”(hÊ)”}”(hŒ"Responsible use of AI to find bugs”h]”hŒ"Responsible use of AI to find bugs”…””}”(hjÉ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjÆ  h²hh³hÃh´K«ubhÚ)”}”(hXÖ  A significant fraction of bug reports submitted to the security team are
actually the result of code reviews assisted by AI tools. While this can be an
efficient means to find bugs in rarely explored areas, it causes an overload on
maintainers, who are sometimes forced to ignore such reports due to their poor
quality or accuracy. As such, reporters must be particularly cautious about a
number of points which tend to make these reports needlessly difficult to
handle:”h]”hXÖ  A significant fraction of bug reports submitted to the security team are
actually the result of code reviews assisted by AI tools. While this can be an
efficient means to find bugs in rarely explored areas, it causes an overload on
maintainers, who are sometimes forced to ignore such reports due to their poor
quality or accuracy. As such, reporters must be particularly cautious about a
number of points which tend to make these reports needlessly difficult to
handle:”…””}”(hj×  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K­hjÆ  h²hubj  )”}”(hXv  * **Length**: AI-generated reports tend to be excessively long, containing
  multiple sections and excessive detail. This makes it difficult to spot
  important information such as affected files, versions, and impact. Please
  ensure that a clear summary of the problem and all critical details are
  presented first. Do not require triage engineers to scan multiple pages of
  text. Configure your tools to produce concise, human-style reports.

* **Formatting**: Most AI-generated reports are littered with Markdown tags.
  These decorations complicate the search for important information and do
  not survive the quoting processes involved in forwarding or replying.
  Please **always convert your report to plain text** without any formatting
  decorations before sending it.

* **Impact Evaluation**: Many AI-generated reports lack an understanding
  of the kernel's threat model (see Documentation/process/threat-model.rst)
  and go to great lengths inventing theoretical consequences. This adds
  noise and complicates triage. Please stick to verifiable facts (e.g.,
  "this bug permits any user to gain CAP_NET_ADMIN") without enumerating
  speculative implications. Have your tool read this documentation as
  part of the evaluation process.

* **Reproducer**: AI-based tools are often capable of generating reproducers.
  Please always ensure your tool provides one and **test it thoroughly**. If
  the reproducer does not work, or if the tool cannot produce one, the
  validity of the report should be seriously questioned. Note that since the
  report will be posted to a public list, the reproducer should only be
  shared upon maintainers' request.

* **Propose a Fix**: Many AI tools are actually better at writing code than
  evaluating it. Please ask your tool to propose a fix and **test it** before
  reporting the problem. If the fix cannot be tested because it relies on
  rare hardware or almost extinct network protocols, the issue is likely not
  a security bug. In any case, if a fix is proposed, it must adhere to
  Documentation/process/submitting-patches.rst and include a 'Fixes:' tag
  designating the commit that introduced the bug.
”h]”j#  )”}”(hhh]”(j(  )”}”(hX³  **Length**: AI-generated reports tend to be excessively long, containing
multiple sections and excessive detail. This makes it difficult to spot
important information such as affected files, versions, and impact. Please
ensure that a clear summary of the problem and all critical details are
presented first. Do not require triage engineers to scan multiple pages of
text. Configure your tools to produce concise, human-style reports.
”h]”hÚ)”}”(hX²  **Length**: AI-generated reports tend to be excessively long, containing
multiple sections and excessive detail. This makes it difficult to spot
important information such as affected files, versions, and impact. Please
ensure that a clear summary of the problem and all critical details are
presented first. Do not require triage engineers to scan multiple pages of
text. Configure your tools to produce concise, human-style reports.”h]”(j  )”}”(hŒ
**Length**”h]”hŒLength”…””}”(hjô  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjð  ubhX¨  : AI-generated reports tend to be excessively long, containing
multiple sections and excessive detail. This makes it difficult to spot
important information such as affected files, versions, and impact. Please
ensure that a clear summary of the problem and all critical details are
presented first. Do not require triage engineers to scan multiple pages of
text. Configure your tools to produce concise, human-style reports.”…””}”(hjð  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Kµhjì  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hjé  ubj(  )”}”(hXD  **Formatting**: Most AI-generated reports are littered with Markdown tags.
These decorations complicate the search for important information and do
not survive the quoting processes involved in forwarding or replying.
Please **always convert your report to plain text** without any formatting
decorations before sending it.
”h]”hÚ)”}”(hXC  **Formatting**: Most AI-generated reports are littered with Markdown tags.
These decorations complicate the search for important information and do
not survive the quoting processes involved in forwarding or replying.
Please **always convert your report to plain text** without any formatting
decorations before sending it.”h]”(j  )”}”(hŒ**Formatting**”h]”hŒ
Formatting”…””}”(hj  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hj  ubhŒÓ: Most AI-generated reports are littered with Markdown tags.
These decorations complicate the search for important information and do
not survive the quoting processes involved in forwarding or replying.
Please ”…””}”(hj  h²hh³Nh´Nubj  )”}”(hŒ,**always convert your report to plain text**”h]”hŒ(always convert your report to plain text”…””}”(hj,  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hj  ubhŒ6 without any formatting
decorations before sending it.”…””}”(hj  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´K¼hj  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hjé  ubj(  )”}”(hXÈ  **Impact Evaluation**: Many AI-generated reports lack an understanding
of the kernel's threat model (see Documentation/process/threat-model.rst)
and go to great lengths inventing theoretical consequences. This adds
noise and complicates triage. Please stick to verifiable facts (e.g.,
"this bug permits any user to gain CAP_NET_ADMIN") without enumerating
speculative implications. Have your tool read this documentation as
part of the evaluation process.
”h]”hÚ)”}”(hXÇ  **Impact Evaluation**: Many AI-generated reports lack an understanding
of the kernel's threat model (see Documentation/process/threat-model.rst)
and go to great lengths inventing theoretical consequences. This adds
noise and complicates triage. Please stick to verifiable facts (e.g.,
"this bug permits any user to gain CAP_NET_ADMIN") without enumerating
speculative implications. Have your tool read this documentation as
part of the evaluation process.”h]”(j  )”}”(hŒ**Impact Evaluation**”h]”hŒImpact Evaluation”…””}”(hjR  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjN  ubhX¸  : Many AI-generated reports lack an understanding
of the kernelâ€™s threat model (see Documentation/process/threat-model.rst)
and go to great lengths inventing theoretical consequences. This adds
noise and complicates triage. Please stick to verifiable facts (e.g.,
â€œthis bug permits any user to gain CAP_NET_ADMINâ€) without enumerating
speculative implications. Have your tool read this documentation as
part of the evaluation process.”…””}”(hjN  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KÂhjJ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hjé  ubj(  )”}”(hX  **Reproducer**: AI-based tools are often capable of generating reproducers.
Please always ensure your tool provides one and **test it thoroughly**. If
the reproducer does not work, or if the tool cannot produce one, the
validity of the report should be seriously questioned. Note that since the
report will be posted to a public list, the reproducer should only be
shared upon maintainers' request.
”h]”hÚ)”}”(hXŽ  **Reproducer**: AI-based tools are often capable of generating reproducers.
Please always ensure your tool provides one and **test it thoroughly**. If
the reproducer does not work, or if the tool cannot produce one, the
validity of the report should be seriously questioned. Note that since the
report will be posted to a public list, the reproducer should only be
shared upon maintainers' request.”h]”(j  )”}”(hŒ**Reproducer**”h]”hŒ
Reproducer”…””}”(hjx  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjt  ubhŒn: AI-based tools are often capable of generating reproducers.
Please always ensure your tool provides one and ”…””}”(hjt  h²hh³Nh´Nubj  )”}”(hŒ**test it thoroughly**”h]”hŒtest it thoroughly”…””}”(hjŠ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjt  ubhŒþ. If
the reproducer does not work, or if the tool cannot produce one, the
validity of the report should be seriously questioned. Note that since the
report will be posted to a public list, the reproducer should only be
shared upon maintainersâ€™ request.”…””}”(hjt  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KÊhjp  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hjé  ubj(  )”}”(hXæ  **Propose a Fix**: Many AI tools are actually better at writing code than
evaluating it. Please ask your tool to propose a fix and **test it** before
reporting the problem. If the fix cannot be tested because it relies on
rare hardware or almost extinct network protocols, the issue is likely not
a security bug. In any case, if a fix is proposed, it must adhere to
Documentation/process/submitting-patches.rst and include a 'Fixes:' tag
designating the commit that introduced the bug.
”h]”hÚ)”}”(hXå  **Propose a Fix**: Many AI tools are actually better at writing code than
evaluating it. Please ask your tool to propose a fix and **test it** before
reporting the problem. If the fix cannot be tested because it relies on
rare hardware or almost extinct network protocols, the issue is likely not
a security bug. In any case, if a fix is proposed, it must adhere to
Documentation/process/submitting-patches.rst and include a 'Fixes:' tag
designating the commit that introduced the bug.”h]”(j  )”}”(hŒ**Propose a Fix**”h]”hŒPropose a Fix”…””}”(hj°  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hj¬  ubhŒr: Many AI tools are actually better at writing code than
evaluating it. Please ask your tool to propose a fix and ”…””}”(hj¬  h²hh³Nh´Nubj  )”}”(hŒ**test it**”h]”hŒtest it”…””}”(hjÂ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hj¬  ubhX[   before
reporting the problem. If the fix cannot be tested because it relies on
rare hardware or almost extinct network protocols, the issue is likely not
a security bug. In any case, if a fix is proposed, it must adhere to
Documentation/process/submitting-patches.rst and include a â€˜Fixes:â€™ tag
designating the commit that introduced the bug.”…””}”(hj¬  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KÑhj¨  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j'  hjé  ubeh}”(h]”h ]”h"]”h$]”h&]”jÇ  jÈ  uh1j"  h³hÃh´Kµhjå  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j  h³hÃh´KµhjÆ  h²hubhÚ)”}”(hŒRFailure to consider these points exposes your report to the risk of being
ignored.”h]”hŒRFailure to consider these points exposes your report to the risk of being
ignored.”…””}”(hjì  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KÙhjÆ  h²hubhÚ)”}”(hX÷  Use common sense when evaluating the report. If the affected file has not been
touched for more than one year and is maintained by a single individual, it is
likely that usage has declined and exposed users are virtually non-existent
(e.g., drivers for very old hardware, obsolete filesystems). In such cases,
there is no need to consume a maintainer's time with an unimportant report. If
the issue is clearly trivial and publicly discoverable, you should report it
directly to the public mailing lists.”h]”hXù  Use common sense when evaluating the report. If the affected file has not been
touched for more than one year and is maintained by a single individual, it is
likely that usage has declined and exposed users are virtually non-existent
(e.g., drivers for very old hardware, obsolete filesystems). In such cases,
there is no need to consume a maintainerâ€™s time with an unimportant report. If
the issue is clearly trivial and publicly discoverable, you should report it
directly to the public mailing lists.”…””}”(hjú  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´KÜhjÆ  h²hubeh}”(h]”Œ"responsible-use-of-ai-to-find-bugs”ah ]”h"]”Œ"responsible use of ai to find bugs”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´K«ubhÅ)”}”(hhh]”(hÊ)”}”(hŒSending the report”h]”hŒSending the report”…””}”(hj  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhj  h²hh³hÃh´KåubhÚ)”}”(hŒÑReports are to be sent over e-mail exclusively.  Please use a working e-mail
address, preferably the same that you want to appear in ``Reported-by`` tags
if any.  If unsure, send your report to yourself first.”h]”(hŒ…Reports are to be sent over e-mail exclusively.  Please use a working e-mail
address, preferably the same that you want to appear in ”…””}”(hj!  h²hh³Nh´Nubj%  )”}”(hŒ``Reported-by``”h]”hŒReported-by”…””}”(hj)  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j$  hj!  ubhŒ= tags
if any.  If unsure, send your report to yourself first.”…””}”(hj!  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Kçhj  h²hubhÚ)”}”(hXe  The security team and maintainers almost always require additional
information beyond what was initially provided in a report and rely on
active and efficient collaboration with the reporter to perform further
testing (e.g., verifying versions, configuration options, mitigations, or
patches). Before contacting the security team, the reporter must ensure
they are available to explain their findings, engage in discussions, and
run additional tests.  Reports where the reporter does not respond promptly
or cannot effectively discuss their findings may be abandoned if the
communication does not quickly improve.”h]”hXe  The security team and maintainers almost always require additional
information beyond what was initially provided in a report and rely on
active and efficient collaboration with the reporter to perform further
testing (e.g., verifying versions, configuration options, mitigations, or
patches). Before contacting the security team, the reporter must ensure
they are available to explain their findings, engage in discussions, and
run additional tests.  Reports where the reporter does not respond promptly
or cannot effectively discuss their findings may be abandoned if the
communication does not quickly improve.”…””}”(hjA  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Këhj  h²hubhÚ)”}”(hXÓ  The report must be sent to maintainers.  If there are two or fewer
recipients in your message, you must also always Cc: the Linux kernel
security team who will ensure the message is delivered to the proper
people, and will be able to assist small maintainer teams with processes
they may not be familiar with.  For larger teams, Cc: the Linux kernel
security team for your first few reports or when seeking specific help,
such as when resending a message which got no response within a week.
Once you have become comfortable with the process for a few reports, it is
no longer necessary to Cc: the security list when sending to large teams.
The Linux kernel security team can be contacted by email at
<security@kernel.org>.  This is a private list of security officers
who will help verify the bug report and assist developers working on a fix.
It is possible that the security team will bring in extra help from area
maintainers to understand and fix the security vulnerability.”h]”(hX¾  The report must be sent to maintainers.  If there are two or fewer
recipients in your message, you must also always Cc: the Linux kernel
security team who will ensure the message is delivered to the proper
people, and will be able to assist small maintainer teams with processes
they may not be familiar with.  For larger teams, Cc: the Linux kernel
security team for your first few reports or when seeking specific help,
such as when resending a message which got no response within a week.
Once you have become comfortable with the process for a few reports, it is
no longer necessary to Cc: the security list when sending to large teams.
The Linux kernel security team can be contacted by email at
<”…””}”(hjO  h²hh³Nh´NubhŒ	reference”“”)”}”(hŒsecurity@kernel.org”h]”hŒsecurity@kernel.org”…””}”(hjY  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”Œmailto:security@kernel.org”uh1jW  hjO  ubhX  >.  This is a private list of security officers
who will help verify the bug report and assist developers working on a fix.
It is possible that the security team will bring in extra help from area
maintainers to understand and fix the security vulnerability.”…””}”(hjO  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Kõhj  h²hubhÚ)”}”(hX6  Please send **plain text** emails without attachments where possible.
It is much harder to have a context-quoted discussion about a complex
issue if all the details are hidden away in attachments.  Think of it like a
:doc:`regular patch submission <../process/submitting-patches>`
(even if you don't have a patch yet): describe the problem and impact, list
reproduction steps, and follow it with a proposed fix, all in plain text.
Markdown, HTML and RST formatted reports are particularly frowned upon since
they're quite hard to read for humans and encourage to use dedicated viewers,
sometimes online, which by definition is not acceptable for a confidential
security report. Note that some mailers tend to mangle formatting of plain
text by default, please consult Documentation/process/email-clients.rst for
more info.”h]”(hŒPlease send ”…””}”(hjs  h²hh³Nh´Nubj  )”}”(hŒ**plain text**”h]”hŒ
plain text”…””}”(hj{  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hjs  ubhŒ¿ emails without attachments where possible.
It is much harder to have a context-quoted discussion about a complex
issue if all the details are hidden away in attachments.  Think of it like a
”…””}”(hjs  h²hh³Nh´Nubh)”}”(hŒ?:doc:`regular patch submission <../process/submitting-patches>`”h]”hŒinline”“”)”}”(hj  h]”hŒregular patch submission”…””}”(hj“  h²hh³Nh´Nubah}”(h]”h ]”(Œxref”Œstd”Œstd-doc”eh"]”h$]”h&]”uh1j‘  hj  ubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”Œprocess/security-bugs”Œ	refdomain”jž  Œreftype”Œdoc”Œrefexplicit”ˆŒrefwarn”ˆŒ	reftarget”Œ../process/submitting-patches”uh1hh³hÃh´Mhjs  ubhX"  
(even if you donâ€™t have a patch yet): describe the problem and impact, list
reproduction steps, and follow it with a proposed fix, all in plain text.
Markdown, HTML and RST formatted reports are particularly frowned upon since
theyâ€™re quite hard to read for humans and encourage to use dedicated viewers,
sometimes online, which by definition is not acceptable for a confidential
security report. Note that some mailers tend to mangle formatting of plain
text by default, please consult Documentation/process/email-clients.rst for
more info.”…””}”(hjs  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´Mhj  h²hubeh}”(h]”Œsending-the-report”ah ]”h"]”Œsending the report”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´KåubhÅ)”}”(hhh]”(hÊ)”}”(hŒ$Disclosure and embargoed information”h]”hŒ$Disclosure and embargoed information”…””}”(hjÇ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjÄ  h²hh³hÃh´MubhÚ)”}”(hŒQThe security list is not a disclosure channel.  For that, see Coordination
below.”h]”hŒQThe security list is not a disclosure channel.  For that, see Coordination
below.”…””}”(hjÕ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´MhjÄ  h²hubhÚ)”}”(hŒzOnce a robust fix has been developed, the release process starts.  Fixes
for publicly known bugs are released immediately.”h]”hŒzOnce a robust fix has been developed, the release process starts.  Fixes
for publicly known bugs are released immediately.”…””}”(hjã  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´MhjÄ  h²hubhÚ)”}”(hX  Although our preference is to release fixes for publicly undisclosed bugs
as soon as they become available, this may be postponed at the request of
the reporter or an affected party for up to 7 calendar days from the start
of the release process, with an exceptional extension to 14 calendar days
if it is agreed that the criticality of the bug requires more time.  The
only valid reason for deferring the publication of a fix is to accommodate
the logistics of QA and large scale rollouts which require release
coordination.”h]”hX  Although our preference is to release fixes for publicly undisclosed bugs
as soon as they become available, this may be postponed at the request of
the reporter or an affected party for up to 7 calendar days from the start
of the release process, with an exceptional extension to 14 calendar days
if it is agreed that the criticality of the bug requires more time.  The
only valid reason for deferring the publication of a fix is to accommodate
the logistics of QA and large scale rollouts which require release
coordination.”…””}”(hjñ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´MhjÄ  h²hubhÚ)”}”(hX|  While embargoed information may be shared with trusted individuals in
order to develop a fix, such information will not be published alongside
the fix or on any other disclosure channel without the permission of the
reporter.  This includes but is not limited to the original bug report
and followup discussions (if any), exploits, CVE information or the
identity of the reporter.”h]”hX|  While embargoed information may be shared with trusted individuals in
order to develop a fix, such information will not be published alongside
the fix or on any other disclosure channel without the permission of the
reporter.  This includes but is not limited to the original bug report
and followup discussions (if any), exploits, CVE information or the
identity of the reporter.”…””}”(hjÿ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´M#hjÄ  h²hubhÚ)”}”(hŒíIn other words our only interest is in getting bugs fixed.  All other
information submitted to the security list and any followup discussions
of the report are treated confidentially even after the embargo has been
lifted, in perpetuity.”h]”hŒíIn other words our only interest is in getting bugs fixed.  All other
information submitted to the security list and any followup discussions
of the report are treated confidentially even after the embargo has been
lifted, in perpetuity.”…””}”(hj  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´M*hjÄ  h²hubeh}”(h]”Œ$disclosure-and-embargoed-information”ah ]”h"]”Œ$disclosure and embargoed information”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´MubhÅ)”}”(hhh]”(hÊ)”}”(hŒCoordination with other groups”h]”hŒCoordination with other groups”…””}”(hj&  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhj#  h²hh³hÃh´M0ubhÚ)”}”(hXº  While the kernel security team solely focuses on getting bugs fixed,
other groups focus on fixing issues in distros and coordinating
disclosure between operating system vendors.  Coordination is usually
handled by the "linux-distros" mailing list and disclosure by the
public "oss-security" mailing list, both of which are closely related
and presented in the linux-distros wiki:
<https://oss-security.openwall.org/wiki/mailing-lists/distros>”h]”(hX…  While the kernel security team solely focuses on getting bugs fixed,
other groups focus on fixing issues in distros and coordinating
disclosure between operating system vendors.  Coordination is usually
handled by the â€œlinux-distrosâ€ mailing list and disclosure by the
public â€œoss-securityâ€ mailing list, both of which are closely related
and presented in the linux-distros wiki:
<”…””}”(hj4  h²hh³Nh´NubjX  )”}”(hŒ<https://oss-security.openwall.org/wiki/mailing-lists/distros”h]”hŒ<https://oss-security.openwall.org/wiki/mailing-lists/distros”…””}”(hj<  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”j>  uh1jW  hj4  ubhŒ>”…””}”(hj4  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´M2hj#  h²hubhÚ)”}”(hXµ  Please note that the respective policies and rules are different since
the 3 lists pursue different goals.  Coordinating between the kernel
security team and other teams is difficult since for the kernel security
team occasional embargoes (as subject to a maximum allowed number of
days) start from the availability of a fix, while for "linux-distros"
they start from the initial post to the list regardless of the
availability of a fix.”h]”hX¹  Please note that the respective policies and rules are different since
the 3 lists pursue different goals.  Coordinating between the kernel
security team and other teams is difficult since for the kernel security
team occasional embargoes (as subject to a maximum allowed number of
days) start from the availability of a fix, while for â€œlinux-distrosâ€
they start from the initial post to the list regardless of the
availability of a fix.”…””}”(hjU  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´M:hj#  h²hubhÚ)”}”(hX   As such, the kernel security team strongly recommends that as a reporter
of a potential security issue you DO NOT contact the "linux-distros"
mailing list UNTIL a fix is accepted by the affected code's maintainers
and you have read the distros wiki page above and you fully understand
the requirements that contacting "linux-distros" will impose on you and
the kernel community.  This also means that in general it doesn't make
sense to Cc: both lists at once, except maybe for coordination if and
while an accepted fix has not yet been merged.  In other words, until a
fix is accepted do not Cc: "linux-distros", and after it's merged do not
Cc: the kernel security team.”h]”hX²  As such, the kernel security team strongly recommends that as a reporter
of a potential security issue you DO NOT contact the â€œlinux-distrosâ€
mailing list UNTIL a fix is accepted by the affected codeâ€™s maintainers
and you have read the distros wiki page above and you fully understand
the requirements that contacting â€œlinux-distrosâ€ will impose on you and
the kernel community.  This also means that in general it doesnâ€™t make
sense to Cc: both lists at once, except maybe for coordination if and
while an accepted fix has not yet been merged.  In other words, until a
fix is accepted do not Cc: â€œlinux-distrosâ€, and after itâ€™s merged do not
Cc: the kernel security team.”…””}”(hjc  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´MBhj#  h²hubeh}”(h]”Œcoordination-with-other-groups”ah ]”h"]”Œcoordination with other groups”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´M0ubhÅ)”}”(hhh]”(hÊ)”}”(hŒCVE assignment”h]”hŒCVE assignment”…””}”(hj|  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjy  h²hh³hÃh´MNubhÚ)”}”(hXG  The security team does not assign CVEs, nor do we require them for
reports or fixes, as this can needlessly complicate the process and may
delay the bug handling.  If a reporter wishes to have a CVE identifier
assigned for a confirmed issue, they can contact the :doc:`kernel CVE
assignment team<../process/cve>` to obtain one.”h]”(hX  The security team does not assign CVEs, nor do we require them for
reports or fixes, as this can needlessly complicate the process and may
delay the bug handling.  If a reporter wishes to have a CVE identifier
assigned for a confirmed issue, they can contact the ”…””}”(hjŠ  h²hh³Nh´Nubh)”}”(hŒ1:doc:`kernel CVE
assignment team<../process/cve>`”h]”j’  )”}”(hj”  h]”hŒkernel CVE
assignment team”…””}”(hj–  h²hh³Nh´Nubah}”(h]”h ]”(j  Œstd”Œstd-doc”eh"]”h$]”h&]”uh1j‘  hj’  ubah}”(h]”h ]”h"]”h$]”h&]”Œrefdoc”jª  Œ	refdomain”j   Œreftype”Œdoc”Œrefexplicit”ˆŒrefwarn”ˆj°  Œ../process/cve”uh1hh³hÃh´MPhjŠ  ubhŒ to obtain one.”…””}”(hjŠ  h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´MPhjy  h²hubeh}”(h]”Œcve-assignment”ah ]”h"]”Œcve assignment”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´MNubhÅ)”}”(hhh]”(hÊ)”}”(hŒNon-disclosure agreements”h]”hŒNon-disclosure agreements”…””}”(hjÇ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjÄ  h²hh³hÃh´MWubhÚ)”}”(hŒpThe Linux kernel security team is not a formal body and therefore unable
to enter any non-disclosure agreements.”h]”hŒpThe Linux kernel security team is not a formal body and therefore unable
to enter any non-disclosure agreements.”…””}”(hjÕ  h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÙh³hÃh´MYhjÄ  h²hubeh}”(h]”Œnon-disclosure-agreements”ah ]”h"]”Œnon-disclosure agreements”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´MWubeh}”(h]”(Œsecurity-bugs”hÂeh ]”h"]”(Œsecurity bugs”Œsecuritybugs”eh$]”h&]”uh1hÄhhh²hh³hÃh´KŒexpect_referenced_by_name”}”jñ  h·sŒexpect_referenced_by_id”}”hÂh·subeh}”(h]”h ]”h"]”h$]”h&]”Œsource”hÃuh1hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(hÉNŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”Œentry”Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”j  Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”hÃŒ_destination”NŒ_config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒraw_enabled”KŒline_length_limit”M'Œpep_references”NŒpep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œimage_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”hÂ]”h·asŒnameids”}”(jñ  hÂjð  jí  j  jŠ  jú  j÷  jÃ  jÀ  j  j
  jÁ  j¾  j   j  jv  js  jÁ  j¾  jè  jå  uŒ	nametypes”}”(jñ  ˆjð  ‰j  ‰jú  ‰jÃ  ‰j  ‰jÁ  ‰j   ‰jv  ‰jÁ  ‰jè  ‰uh}”(hÂhÆjí  hÆjŠ  héj÷  j  jÀ  jý  j
  jÆ  j¾  j  j  jÄ  js  j#  j¾  jy  jå  jÄ  uŒfootnote_refs”}”Œcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”Œ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œ
id_counter”Œcollections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”hŒsystem_message”“”)”}”(hhh]”hÚ)”}”(hhh]”hŒ2Hyperlink target "securitybugs" is not referenced.”…””}”hj…  sbah}”(h]”h ]”h"]”h$]”h&]”uh1hÙhj‚  ubah}”(h]”h ]”h"]”h$]”h&]”Œlevel”KŒtype”ŒINFO”Œsource”hÃŒline”Kuh1j€  ubaŒtransformer”NŒinclude_log”]”Œ
decoration”Nh²hub.