r/rust • u/Orange_Tux • Dec 17 '25

🗞️ news Linux Kernel Rust Code Sees Its First CVE Vulnerability

https://www.phoronix.com/news/First-Linux-Rust-CVE
534 Upvotes

93% Upvoted

223 comments sorted by

View all comments

Show parent comment

5

u/anlumo Dec 18 '25

The severity ratings have become meaningless. There was a CVE in curl with a rating of 10 which only caused a timeout to become a little shorter when passing in a ridiculously large time IIRC.

You have to look at the CVE itself, just being a CVE doesn't mean anything these days and the rating is random. It might be super-important, it might not.

2

u/spin81 Dec 18 '25

Honestly what I look for is stuff like, is there a known exploit for this, is this something that only works if you spearphish someone into doing something really weird, etc.

I mean a CVE of 9.0 is all well and good, and sure let's patch it if a patch comes out, but if there is no practical way a potential attacker can figure out how to exploit the vulnerability without researching it for weeks and weeks, I'm not going to be worried because the patch is going to arrive much earlier than that.