Security and Responsible Disclosure

Reporting Security Issues

Security issues may be reported to:

mchehab at kernel.org

Use this private reporting route for suspected vulnerabilities, including issues that may affect confidentiality, integrity, availability, privilege boundaries, or the safe operation of this software.

Ordinary bugs and feature requests should instead be raised through the project’s normal public reporting or discussion channel.

Reports should include, when available:

  • the affected revision or release

  • the configuration and environment in which the issue was observed

  • steps, test data, or code sufficient to reproduce the issue

  • the expected and observed security impact

  • any proposed patch or mitigation

Receipt, acknowledgement, investigation, remediation, advisory publication, and vulnerability-identifier coordination are performed on a best-effort basis. The project does not guarantee a response time, a fix, an embargo period, or assignment of a vulnerability identifier.

Please avoid public disclosure of suspected vulnerabilities until the issue has been reviewed where possible. Reporters and the project may coordinate a disclosure date appropriate to the issue and the availability of a fix. When practical, security fixes will be identified in public commit messages, release notes, or advisories after coordinated disclosure. These practices are voluntary and do not create a support commitment.

Project Role and Scope

This is an independent upstream free and open-source software project. Its source code, release archives, and documentation are publicly available for general-purpose use without charge. Any security fixes or updates that the project elects to publish are made available through the upstream project. Access is not conditioned on payment, the purchase of support, the provision of personal data, or entry into a commercial agreement. The project does not offer a paid edition, hosted service, or commercial support. In their upstream project roles, its maintainers and individual contributors do not package, place on the market, or support products that incorporate this software.

Maintainers and contributors may be employed, sponsored, or otherwise funded by organizations that package, integrate, distribute, or use this software. The circumstances in which upstream work is funded do not condition access to the upstream software and do not by themselves transfer a downstream manufacturer’s responsibilities to this project, its maintainers, or its individual contributors. When governing, contributing to, or releasing this upstream project, maintainers and contributors do not make commitments on behalf of an employer’s or another organization’s downstream product.

Any duties an individual may have in a separate employment or commercial role are outside the scope of their participation in this project and this policy.

Security Maintenance Model

Security review, patch development, and vulnerability remediation are performed on a best-effort basis and may depend on community contributions.

The project, its maintainers, and its individual contributors do not guarantee response times, security updates, or continued maintenance of any particular version.

Responsibilities of Distributors and Operators

Entities that package, distribute, integrate, or deploy this software remain responsible for assessing and meeting the security, support, notification, and regulatory requirements applicable to their own products and deployments. An upstream report, advisory, patch, or release does not replace that assessment or satisfy a downstream entity’s reporting obligations.

This includes, but is not limited to:

  • monitoring for security advisories

  • applying or backporting security patches

  • validating fixes in their environments

  • distributing updates to their users

  • complying with applicable regulatory or operational requirements

Distributors and other parties that deploy this software shall not rely on an upstream maintainer, an individual contributor, or this project’s reporting address to perform regulatory monitoring, assessment, or notification.

Downstream manufacturers are encouraged, and may be legally required, to report vulnerabilities affecting this software and to share relevant security fixes through the reporting route above. Receipt, investigation, or handling of such a report by this project does not transfer, replace, or satisfy the downstream entity’s security, support, or regulatory obligations.

In particular, this project does not undertake to assess or submit reports under the EU Cyber Resilience Act on behalf of downstream manufacturers, distributors, integrators, or any other organizations.

Supported Versions

No released version is designated as supported, and no release has a promised security-support period or end-of-life maintenance commitment. Security fixes, if any, may be developed against the current development code or applied to selected releases at the discretion of the maintainers.

Distributors and parties that deploy this software are solely responsible for maintaining the versions they package or deploy.

No Operational Control

Because this project is distributed as standalone software and source code, its maintainers and individual contributors do not control how the software is compiled, packaged, deployed, or operated by third parties.

Responsibility for the security and maintenance of deployed systems remains with the parties operating or distributing the software.

No Compliance Representation

The project, its maintainers, and its individual contributors make no representation of compliance with the EU Cyber Resilience Act or other product legislation. This documentation voluntarily describes upstream project practices and is provided as-is, without warranties or guarantees. It is not a certification, conformity assessment, or regulatory assurance.

Organizations that incorporate this software into products remain responsible for independently determining and satisfying the legal requirements applicable to those products.

This documentation may inform a downstream risk assessment, but it does not by itself establish conformity or compliance of any product. See the project’s license file for the applicable license and warranty terms.

This policy does not create a contract, warranty, support commitment, or legal or regulatory obligation beyond the applicable license and any separate written agreement entered into by the relevant parties.

Requests from Downstream Organizations

The upstream project, its maintainers, and its contributors do not undertake a downstream manufacturer’s CRA assessment, conformity declaration, product support obligations, or regulatory reporting. They do not, on behalf of the upstream project, complete supplier questionnaires, certify the security or compliance of downstream products, guarantee the absence of vulnerabilities, or accept the role or obligations of a manufacturer, importer, distributor, authorized representative, or other economic operator for a downstream product.

Downstream organizations should report vulnerabilities and share relevant fixes through the security-reporting process above. They remain responsible for assessing, securing, supporting, and meeting the regulatory requirements of the products and versions they distribute or operate. A maintainer or contributor may make different commitments only in a separate written agreement and a separate commercial or employment role; such commitments are not made by, or on behalf of, this upstream project.