From: Willy Tarreau Date: Sun, 2 Aug 2026 20:35:38 +0000 (+0200) Subject: docs: security-bugs: clarify what counts as a valid version X-Git-Tag: v7.2-rc7~8^2~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e447f7f33fa0a50d42d0539c161a662e67bd1a2c;p=thirdparty%2Flinux.git docs: security-bugs: clarify what counts as a valid version Too often we're getting reports saying "still valid in latest mainline" with no indication of when this was verified, making this indication pointless. Let's clarify it and insist on having a version or commit ID, and that the version must necessarily be for a kernel.org kernel and not a distro one. Cc: Greg KH Signed-off-by: Willy Tarreau Link: https://patch.msgid.link/20260802203540.3453-4-w@1wt.eu Signed-off-by: Greg Kroah-Hartman --- diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index 3c51ddde31dd..6f7c21515e9e 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -18,6 +18,10 @@ information is helpful. The following information are absolutely necessary in **any** security bug report: * **affected kernel version range**: with no version indication, your report + will not be processed. Note that a time-dependent version such as "latest + mainline" is not acceptable. A stable identifier such as a commit ID or an + exact version is required. Versions designating kernels not coming from + kernel.org (such as distro kernels) are meaningless to maintainers and will not be processed. A significant part of reports are for bugs that have already been fixed, so it is extremely important that vulnerabilities are verified on recent versions (development tree or latest stable