Re: [PATCH 03/14] docs: security-bugs: never publish reproducers of bugs with a security impact

[Johan Hovold <johan@kernel.org>]

On Mon, Nov 09, 2026 at 09:02:29AM +0100, Willy Tarreau wrote:

> diff --git a/Documentation/process/threat-model.rst b/Documentation/process/threat-model.rst
> index 04e5df6a6f78b..72cb36dd383d6 100644
> --- a/Documentation/process/threat-model.rst
> +++ b/Documentation/process/threat-model.rst
> @@ -105,7 +105,21 @@ In the Linux kernel's threat model, the following classes of problems are
>  **NOT** considered Linux Kernel vulnerabilities. However, when it is believed
>  that the kernel could do better, they should be reported, so that they can be
>  reviewed and fixed where reasonably possible, but they will be handled as any
> -regular bug:
> +regular bug.
> +
> +Some of these bugs may still have a security impact for a few users, for
> +example when their exploitation requires a dedicated network link, a crafted
> +device, or a crafted file system image that only root may mount. For the vast
> +majority of users the impact is null, and such isolated bugs do not represent a
> +target worth writing an exploit for, which is why they are handled publicly
> +(a CVE may still be assigned later by the :doc:`CVE team <cve>`). However,
> +publishing a reproducer or an exploit could put the few exposed users at risk.
> +For such bugs, the fix is sent publicly like any regular fix, with a commit
> +message that does not detail how to exploit the bug, while the reproducer and
> +any exploit are only shared privately with the maintainers and are never posted
> +to public lists.
> +
> +The following classes of problems are not considered as vulnerabilities:

s/as//

or 

s/as/to be/?

>  
>  * **Configuration**:

Johan