RE: [PATCH] improve_kernel_cve_report: use numeric versions instead of cpeApplicability

Daniel Turull
2026-04-17T14:35:15Z

True,
I sent CVEs that had different responses. I used an old checkout and rerun with the old and the new script.

I'm starting to find some issues with the data that we should clarify before merging this patch. Let's pause it and have it correct.

For example,
https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-40067.json

"defaultStatus": "affected",
{
"version": "6.6.112",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},

"negate": false,
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.102",
"versionEndExcluding": "6.6.112"
},

In this case, the information in one of the entries is not correct. For example, in 6.6.100 is vulnerable in the version not in the cpeApplicability, but git versions and cpeApplicability match if we do a git describe on them.

I'll send an email to ask for clarification to the kernel security team and try to see other similar cases. I must say that this is a minority of all CVEs.

Also I need to look if this could be integrated in the sbom-cve-check, so we have it only one place. I want to be able to run the script as well with older releases or just telling the kernel to use without SBOM.

Best regards,
Daniel

> -----Original Message-----
> From: Benjamin Robin <benjamin.robin@bootlin.com>
> Sent: Friday, 17 April 2026 15:55
> To: openembedded-core@lists.openembedded.org; Daniel Turull
> <daniel.turull@ericsson.com>
> Subject: Re: [PATCH] improve_kernel_cve_report: use numeric versions
> instead of cpeApplicability
>
> On Friday, April 17, 2026 at 3:44 PM, Daniel Turull wrote:
> > Hi,
> > We had Greg visiting us and I asked him what is better to use and he said git
> or versions, not cvepAplicability that has issues defining trees.
>
> You reply is technically not responding to my question :) Could you provide at
> least one example with an entry that is not correct in the cpeApplicability
> node?
>
> The script had previously various issue (or at least it looked like it).
> I preferred to use a completely different algorithm (and using all sources of
> information)
>
> But since I am also using NVD entries this degrade a bit the quality of the
> generated assessment message
>
> > I have done some comparison with 6.6.100 and 6.18.22
> >
> >
> > === 6.6.100 ===
> > Old: 10900 New: 10898 Match: 10418 Only old: 2 Only new: 0 Diff: 480
> > 327 Unpatched/version-in-range -> Unpatched/version-in-range
> > 106 Patched/fixed-version -> Patched/fixed-version
> > 16 Patched/cpe-stable-backport -> Unpatched/version-in-range
> > 15 Unpatched/version-in-range -> Patched/fixed-version
> > 5 Patched/fixed-version -> Unpatched/known-affected
> > 5 Patched/fixed-version -> Unpatched/version-in-range
> > 2 Patched/cpe-stable-backport -> Patched/fixed-version
> > 1 Patched/version-not-in-range -> Unpatched/version-in-range
> > 1 Patched/cpe-stable-backport -> Unpatched/known-affected
> > 1 Patched/version-not-in-range -> Patched/fixed-version
> > 1 Unpatched/version-in-range -> Unpatched/known-affected
> > Only in old:
> > CVE-2024-0000: Patched/version-not-in-range
> > CVE-2024-0053: Patched/version-not-in-range
> >
> > === 6.18.22 ===
> > Old: 10900 New: 10898 Match: 10877 Only old: 2 Only new: 0 Diff: 21
> > 7 Unpatched/version-in-range -> Unpatched/version-in-range
> > 6 Patched/fixed-version -> Patched/fixed-version
> > 6 Patched/fixed-version -> Unpatched/known-affected
> > 1 Unpatched/version-in-range -> Unpatched/known-affected
> > 1 Unpatched/version-in-range -> Patched/cpe-stable-backport
> > Only in old:
> > CVE-2024-0000: Patched/version-not-in-range
> > CVE-2024-0053: Patched/version-not-in-range
> >
> > old vs new outputs for kernel 6.18.22
> >
> > Old total: 10900
> > New total: 10898
> > Matching: 10877
> > Only in old: 2
> > Only in new: 0
> > Different: 21
> >
> > Difference categories:
> > 7 Unpatched/version-in-range -> Unpatched/version-in-range
> > 6 Patched/fixed-version -> Patched/fixed-version
> > 6 Patched/fixed-version -> Unpatched/known-affected
> > 1 Unpatched/version-in-range -> Unpatched/known-affected
> > 1 Unpatched/version-in-range -> Patched/cpe-stable-backport
> >
> > Only in old (2):
> > CVE-2024-0000: Patched/version-not-in-range: No CPE match
> > CVE-2024-0053: Patched/version-not-in-range: No CPE match
> >
> > Different (all 21):
> > CVE-2021-47295:
> > old: Patched/fixed-version: Fixed from version 6.2.5
> > new: Patched/fixed-version: Fixed from version 5.14
> > CVE-2021-47342:
> > old: Patched/fixed-version: Fixed from version 5.12.5000
> > new: Patched/fixed-version: Fixed from version 5.10.77
> > CVE-2022-50396:
> > old: Patched/fixed-version: Fixed from version 6.2.5
> > new: Patched/fixed-version: Fixed from version 6.2
> > CVE-2023-53012:
> > old: Patched/fixed-version: Fixed from version 6.1.5000
> > new: Unpatched/known-affected: No known resolution
> > CVE-2023-53187:
> > old: Patched/fixed-version: Fixed from version 5.15.5000
> > new: Unpatched/known-affected: No known resolution
> > CVE-2024-49854:
> > old: Patched/fixed-version: Fixed from version 5.10.5000
> > new: Unpatched/known-affected: No known resolution
> > CVE-2025-38656:
> > old: Patched/fixed-version: Fixed from version 6.12.5000
> > new: Unpatched/known-affected: No known resolution
> > CVE-2025-68195:
> > old: Patched/fixed-version: Fixed from version 6.12.5000
> > new: Unpatched/known-affected: No known resolution
> > CVE-2025-68357:
> > old: Patched/fixed-version: Fixed from version 6.17.5000
> > new: Patched/fixed-version: Fixed from version 6.12.64
> > CVE-2025-71145:
> > old: Patched/fixed-version: Fixed from version 5.10.5000
> > new: Unpatched/known-affected: No known resolution
> > CVE-2026-23288:
> > old: Patched/fixed-version: only affects 6.19.4 onwards
> > new: Patched/fixed-version: only affects 6.19 onwards
> > CVE-2026-23327:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 6.19.7)
> > new: Unpatched/version-in-range: Needs backporting (fixed from 7.0rc2)
> > CVE-2026-23328:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 6.19.7)
> > new: Unpatched/version-in-range: Needs backporting (fixed from 7.0rc3)
> > CVE-2026-23333:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 6.19.4)
> > new: Unpatched/known-affected: No known resolution
> > CVE-2026-23341:
> > old: Patched/fixed-version: only affects 6.19.4 onwards
> > new: Patched/fixed-version: only affects 6.19 onwards
> > CVE-2026-23355:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 7.0rc3)
> > new: Patched/cpe-stable-backport: Backported in 6.18.18
> > CVE-2026-23371:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 6.19.7)
> > new: Unpatched/version-in-range: Needs backporting (fixed from 7.0rc3)
> > CVE-2026-23374:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 6.19.7)
> > new: Unpatched/version-in-range: Needs backporting (fixed from 7.0rc3)
> > CVE-2026-23377:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 6.19.7)
> > new: Unpatched/version-in-range: Needs backporting (fixed from 7.0rc3)
> > CVE-2026-23389:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 6.19.7)
> > new: Unpatched/version-in-range: Needs backporting (fixed from 7.0rc3)
> > CVE-2026-23394:
> > old: Unpatched/version-in-range: Needs backporting (fixed from 6.19.10)
> > new: Unpatched/version-in-range: Needs backporting (fixed from
> > 7.0rc5)
> >
> > Best regards,
> > Daniel
> >
> > > -----Original Message-----
> > > From: Benjamin Robin <benjamin.robin@bootlin.com>
> > > Sent: Friday, 17 April 2026 15:32
> > > To: openembedded-core@lists.openembedded.org; Daniel Turull
> > > <daniel.turull@ericsson.com>
> > > Subject: Re: [PATCH] improve_kernel_cve_report: use numeric versions
> > > instead of cpeApplicability
> > >
> > > [You don't often get email from benjamin.robin@bootlin.com. Learn
> > > why this is important at
> > > https://aka.ms/LearnAboutSenderIdentification ]
> > >
> > > Hello Daniel,
> > >
> > > On Friday, April 17, 2026 at 3:24 PM, daniel.turull@ericsson.com wrote:
> > > > From: Daniel Turull <daniel.turull@ericsson.com>
> > > >
> > > > git shas or versions should be use instead of cpeApplicability.
> > > > Reuse the same logic as generate-cve-exclusions, so outputs are
> consistent.
> > > >
> > > > cpeApplicability does not provide accurate version information and
> > > > for some CVEs the information is not the same. This came from a
> > > > discussion that we had with Greg Kroah-Hartma, member of the Linux
> > > security team.
> > >
> > > Indeed "cpeApplicability" does not provide the same kind of
> > > information that the "versions" node.
> > > In sbom-cve-check (the latest version in main branch) we are using
> > > both sources of information.
> > > But you are saying that "cpeApplicability" does not provide accurate
> > > version information. Could you elaborate and give various examples?
> > > I never saw something invalid in "cpeApplicability".
> > >
>
> --
> Benjamin Robin, Bootlin
> Embedded Linux and Kernel engineering
> https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbootlin
> .com%2F&data=05%7C02%7Cdaniel.turull%40ericsson.com%7Cdbbb990e606
> 245d2f01c08de9c88ecab%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0
> %7C639120309071164067%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcG
> kiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIj
> oyfQ%3D%3D%7C0%7C%7C%7C&sdata=mzgiHIfwb7lLWnnQ%2Fo8KpUkKlUN
> 5KrZb7eij1g%2BTaIg%3D&reserved=0
>
>