Re: [MAINTAINERS SUMMIT] Scaling our security process

[Sasha Levin <sashal@kernel.org>]

On Mon, Jul 27, 2026 at 04:24:39PM +0200, Jiri Kosina wrote:
>On Tue, 14 Jul 2026, Sasha Levin wrote:
>
>> 3. Do we want some sort of a shared distro security backport list? Every
>>    major distro pays people to backport security fixes, and they all do
>>    the same work in parallel behind separate walls. A list where
>>    upstream and distro security teams write and review backports
>>    together, would pool that effort and land fixes where users are.
>>    Sure, it allows for more leaks, but we end up causing these leaks
>>    ourselves when we release a fix without working backports.
>
>Well, linux-distros@ is still there, and is used to coordinate security
>fixes in exactly this way consistently for vast majority of all the
>relevant projects, pretty much except for the kernel. With my distro hat
>on, I'd add "unfortunately".

Just to clarify: I don't propose the new security backport list to be
closed/secret. We have hundreds of known security issues that our users kernels
are vulnerable to, either because there's no backport, the fix fell through the
cracks, etc.

This is my beef with the security@k.o list too: we seem to be overindexing on
some issues, while we just ignore hundreds of other issues that make our users
vulnerable.

I really don't understand why we bother with this whole dance around
embargoed issues.

-- 
Thanks,
Sasha