Re: Linux kernel CVEs not mentioned on oss-security

[Moritz Muehlenhoff <jmm () debian org>]

Priedhorsky, Reid wrote:
> 1. Is oss-security’s coverage of security issues in open-source software intended to be comprehensive? If so, this 
> appears not to be true for the Linux kernel.

No, it's not. oss-security is just another mailing list to report security vulnerabilities,
and not a canonical source.

> 2. Is there another source of comprehensive coverage of vulnerabilities in the Linux kernel, including but not 
> necessarily limited to all CVEs issued for it?

This Debian repo has data on all public kernel vulnerabilities affecting
the mainline Linux kernel: https://anonscm.debian.org/viewvc/kernel-sec/

Cheers,
        Moritz