[$] Managing the kernel CVE flood
We recently looked at how the kernel community is dealing with the firehose of vulnerability reports, but said little about how users of the kernel…
Why am I seeing this Ranked on source trust — LWN
It ranks mainly on source trust: LWN is the most reliable outlet we track on this subject, and is the only one on the story so far.
Single-sourced. No second organisation has confirmed it yet.
Link-outLink-out, because only one organisation carries it and no first-party source is on it and the subject could not be identified from the text. Link-out means we point at the publisher and say nothing of our own.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroboration | 0.35 | 0.39 | +0.135 25% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trustleads | 0.25 | 0.85 | +0.212 39% | LWN is the highest-trust source on this story. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.96 | +0.193 36% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
Roberto Guido and Virginia Foti · CC0 · Wikimedia Commons · illustrativeAWS engineers Dylan Johnson and Justinien Bouron presented at the 2026 Linux Plumbers Conference on how their organization handles the volume of kernel vulnerability disclosures. The presentation examined the practical challenges of maintaining security across AWS infrastructure while managing the constant stream of CVE reports affecting the Linux kernel.
The kernel community has traditionally recommended running current kernel versions as the primary defense against vulnerabilities. However, according to the AWS engineers' discussion, this approach only partially addresses the problem of managing the flood of CVE disclosures that organizations now face.
The presentation highlighted the gap between the kernel community's standard guidance and the real-world constraints that large infrastructure operators encounter when responding to vulnerability reports. The engineers discussed their organization's perspective on balancing security updates with operational stability across their systems.
What happened
We recently looked at how the kernel community is dealing with the firehose of vulnerability reports, but said little about how users of the kernel are responding. At the 2026 Linux Plumbers Conference, Amazon employees Dylan Johnson and Justinien Bouron discussed the problem from the point of view of engineers trying to keep AWS running and secure in the face of a storm of CVE disclosures. The kernel community's longstanding advice is to run current kernels, and that turns out to work — sort of.
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Lwn first seen [$] Managing the kernel CVE flood
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.