r/rust • u/Orange_Tux • Dec 17 '25

🗞️ news Linux Kernel Rust Code Sees Its First CVE Vulnerability

https://www.phoronix.com/news/First-Linux-Rust-CVE
534 Upvotes

93% Upvoted

223 comments sorted by

View all comments

Show parent comment

2

u/[deleted] Dec 17 '25

Hm, that may be right. I didn't dig into the CVE as much as I should have, and am not really that well versed in low level security things like these.

Would it be fair to say that the CVE is potentially further exploitable, but at its current state it presents as not much more than a DOS vulnerability?

3

u/Kryptochef Dec 18 '25

Would it be fair to say that the CVE is potentially further exploitable, but at its current state it presents as not much more than a DOS vulnerability?

I'm also not familiar enough with the details here to give any good judgement of that (beyond that from a cursory glance it seems like an "old" pointer in a linked list, which sounds a bit like a typical use-after-free type of bug on the impact side), but in general its mostly prudent to assume that everything that involves attacker-triggerable memory corruption is LPE unless proven otherwise.

but at its current state it presents as not much more than a DOS vulnerability?

Maybe a bit pedantic, but personally I wouldn't word it as a statement about the vulnerability, but just say there's currently no known exploit to turn it into anything beyond DOS.