Greg Kroah-Hartman
Linux kernel maintainer; runs the stable kernel releases and maintains the USB and driver core subsystems.
Greg Kroah-Hartman did not write this page.
We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.
-
Their wordsPersonally, I think that filesystem corruption or data loss bug fixes should be considered a CVE fix, but until cve.org changes their policy, we can not assign CVEs for those types of fixes.
↗Linux CVE assignment processkroah.com 1st of 3 in this piece
-
Their wordsSo any group that attempts to give a "severity score" to a Linux CVE is lying to you, UNLESS they know exactly your use case.
↗Linux CVE assignment processkroah.com 2nd of 3 in this piece
-
Our reading
NIST/NVD's assignment of CVSS scores to vulnerabilities provides a false sense of security.
Their wordsALWAYS ignore any attempt that groups such as NIST/NVD that purport to assign things like CVSS scores to a vulnerability. Those numbers are false and give companies a "fake sense of security".
↗Linux CVE assignment processkroah.com 3rd of 3 in this piece
- 6 weeks earlier
-
Their wordsThis arrangement has allowed the kernel security team to remain independent and continue to operate across the different governments that the members operate in, and it looks to become the normal way project security teams work with the advent of the European Union's new CRA law coming into affect which places requirements on response time of companies that receive notice of potential security issues in their projects.
-
Their wordsAs history has shown us with Spectre and Meltdown, this "no embargo" policy does not always work well when working with problems that cross operating systems and hardware platforms, possibly requiring firmware or microcode updates.
- 3 weeks earlier
-
Their wordsAll releases are "stable" and backwards compatible for userspace programs to all previous kernel releases.
↗Linux kernel version numberskroah.com 1st of 3 in this piece
-
Their wordsNo kernel release should ever break any existing user's code or workflow.
↗Linux kernel version numberskroah.com 2nd of 3 in this piece
-
Their wordsIt is NOT safe to do a simple "if this version number is bigger than the previous one, then all fixes for it will be in the next release." You have to treat each kernel "branch" as a unique tree, and not compare them against each other in order to be able to properly track changes over time.
↗Linux kernel version numberskroah.com 3rd of 3 in this piece
- 1 day earlier
-
Their wordsdocument a way that people can track CVE assignments on their own in a format that is, in my opinion, much simpler than attempting to rely on the CVE json format (and don't get me started on NVD...)
- 5 years earlier
-
Their wordsThe above is what I need in order to be able to support a kernel for 6 years, constant testing by users of the kernels.
- 2 years earlier
-
Their wordsThe best solution for almost all Linux users is to just use the kernel from your favorite Linux distribution.
↗What Stable Kernel Should I Usekroah.com 1st of 3 in this piece
-
Their wordsThese kernels are not to be used in any type of "general computing" model where you have untrusted users or virtual machines, as the ability to do some of the recent Spectre-type fixes for older releases is greatly reduced, if present at all in some branches.
↗What Stable Kernel Should I Usekroah.com 2nd of 3 in this piece
-
Their wordsThe community can not support you as no one is watching all kernel versions for specific issues, so you will have to rely on in-house support for everything that could go wrong.
↗What Stable Kernel Should I Usekroah.com 3rd of 3 in this piece