Ginux Rust Kernel Receives Security Fixes in 10 Hours While Linux Patch Takes 69 Days to Reach Mainline

A researcher identified multiple vulnerabilities in both the experimental Ginux Rust-based kernel and the upstream Linux kernel, revealing stark differences in development velocity. In Ginux, 15 issues were reported via GitHub, with the first three fixes merged into main within 10 hours and a critical TLS RNG flaw resolved in 12 hours. The Linux kernel patch for Android Binder required 69 days to reach Linus Torvalds' tree after initial submission, despite early review within 11 days. Ginux, created by Rocky Linux founder Gregory Kurtzer, uses AI agents for rapid patching while Linux follows traditional maintainer and release-cycle processes. The researcher used multiple AI models for threat modeling and adversarial verification before submitting PoCs reproduced in QEMU. The findings highlight how agent-driven development can accelerate security response compared to established kernel workflows.

HabrNovember 2, 2026Translated from Russian

Read at source

A security researcher has documented a dramatic difference in how quickly vulnerabilities are addressed in the experimental Ginux Rust kernel versus the upstream Linux kernel. The project Ginux, initiated by Gregory Kurtzer (co-founder of CentOS and creator of Rocky Linux), aims to build an x86-64 UEFI-compatible kernel in Rust with Linux userspace compatibility, relying heavily on AI agents for development.

The researcher ran the Ginux codebase through automated analysis tools and conducted three independent vulnerability searches using multiple large language models. Fifteen issues were reported through GitHub, including a critical flaw in the TLS client for container image registries. The RNG was seeded only with RTC time at boot with one-second precision, causing predictable client_random values and ephemeral keys that allowed passive decryption of recorded TLS traffic.

Responses from maintainer agents arrived within four hours, and the first three fixes were merged into main within 10 hours. The TLS RNG issue was resolved approximately 12 hours after reporting. By the morning of November 2, five fixes had landed in main while ten additional PRs awaited review.

In contrast, the same researcher previously submitted 16 findings across three Linux subsystems, including Android Binder, net/xfrm IP-TFS, and nova-core. One patch for the Rust Binder driver, which replaced KVec with KVVec to avoid unnecessary physically contiguous memory allocations, took 69 days to reach Linus Torvalds' tree after initial submission on August 17. The four-line change addressed a condition where roughly 900,000 file descriptors could trigger WARN messages due to excessive contiguous memory requests.

The researcher noted that Linux follows rigorous compatibility and regression-avoidance processes across billions of devices, while Ginux remains an explicitly experimental prototype. The timeline comparison shows the first Linux response arrived within a day via email, whereas Ginux agents responded in roughly four hours.

Linux kernel Ginux Android Binder Greg Kroah-Hartman Rocky Linux

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

New Container, Old Code: Why the Incident Returned After Three Months

Two 1C-Bitrix sites shared the same web shell WebShellOrb after an attacker exploited multiple vulnerabilities in a legacy self-written application called appeal. The initial compromise occurred via an unauthenticated SQL injection in AppealModel::getReportData combined with JWT authentication bypass and hardcoded secrets. Logs were retained for only one month, so investigators could not trace the entry point and incorrectly concluded there was no persistence after restarting the container. The shared filesystem and single system user allowed the shell to be copied to the second site, while password hashes remained extractable through API methods. Even after password changes and container redeployment, the attacker regained access weeks later because the JWT secret, code flaws, and common storage were never addressed. The case demonstrates that redeploying containers without fixing root vulnerabilities in legacy code leaves systems exposed for months.

HabrNov 2, 2026Translated from Russian

Vulnerabilities & Exploits

OneDrive and SharePoint URLs Enable Corporate Username Enumeration, Microsoft Calls Risk Low

Attackers can discover valid corporate User Principal Names by probing OneDrive and SharePoint URLs without triggering authentication logs. Microsoft acknowledges the reconnaissance technique but classifies it as low severity because a discovered login alone does not bypass multi-factor authentication. The method leaves no traces in Microsoft Entra ID or Microsoft Purview audit logs, and organizations receive no alerts when usernames are enumerated this way. Microsoft limits bulk requests against non-existent OneDrive sites yet does not fully block the enumeration vector. The company recommends organizations rely on conditional access policies, phishing-resistant MFA, and sign-in risk protections to prevent follow-on attacks such as password spraying or targeted phishing. The issue primarily affects small and medium businesses as well as enterprises using Microsoft 365.

AntiMalwareNov 2, 2026Translated from Russian

Vulnerabilities & Exploits

WordPress 7.1.4 Addresses RCE Risk in Upgrade Process and Multiple Stored XSS Vulnerabilities

The WordPress development team released version 7.1.4 on October 28, 2026, as a security update addressing several vulnerabilities in the content management system. The release fixes a flaw in the upgrade process that could allow remote code execution during updates. Multiple stored cross-site scripting issues were also resolved, including those exploitable through specially crafted block markup and manipulated privacy data deletion requests. No CVE identifiers were disclosed in the announcement. Users are strongly urged to apply the update immediately to mitigate potential attacks. The advisory was published by Security NEXT on November 2, 2026.

Security NEXTNov 2, 2026Translated from Japanese