Talk proposal: What 125K kernel bugs tell us about testing gaps

Hi,

I'm a security researcher working on automated kernel vulnerability
detection. I'd love to present at an upcoming Thursday call if there's
interest.

I analyzed every Fixes: tag in the kernel's 20-year git history (125K
bug-fix pairs) and built a model to catch vulnerabilities at commit
time. Some findings that might be relevant to KernelCI's testing
strategy:

- Security bugs hide for 2.1 years on average; race conditions persist 5.0 =
years
- 117 "super-reviewers" (including Dan Carpenter, who invented the
Fixes: tag) catch bugs 47% faster
- Subsystems like CAN bus (4.2 years) and SCTP (4.0 years) have
dramatically longer bug lifetimes than gpu/i915 (1.4 years)
- Weekend commits are 8% less likely to introduce bugs, but take 45%
longer to fix (review coverage effect)

The model (VulnBERT) achieves 92% recall at 1.2% false positive rate
on held-out 2024 data. I'm also working on SmartKuang, an RL-based
system that has reproduced CVE-2022-34918 autonomously.

Happy to do 15-20 min on whatever slice would be most useful=E2=80=94the
dataset findings, the detection approach, or how this could complement
KernelCI's coverage.

Writeups:
- https://pebblebed.com/blog/kernel-bugs
- https://pebblebed.com/blog/kernel-bugs-part2

Jenny
[email protected]