The "if" is doing a lot of heavy lifting. Can it do what it claims to do? LLMs are always hallucinating that they've found the most severe bug in software history.
Good point, I don't know! That's why I formulated it this way.
Edit: I guess what I'm trying to say is, with security relevant things it might do no harm to be a bit more credulous when it comes to initial reports. (In theory, no idea how to best handle the growing flood of LLM generated stuff. Pointing LLMs at each other doesn't seem great.)
> LLMs are always hallucinating that they've found the most severe bug in software history.
That is a function of the training data/method, like many of AI's problems. This doesn't stop it being a problem of course, but it shouldn't be a surprise.
Big bugs, like heartbleed, over the years have had breathy websites going over how serious the problem is because the problem was that serious, so the models associate that sort of wording with bug reports. Less serious bugs don't get the same excited treatment, repeated in many many places, so more measured descriptions figure in the training data relatively less.
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a patch was pushed to AOSP in October:
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:
Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.
My previous question does not indicate more belief than that it might be true, so I can't answer you there. Should I adopt the belief any information put into words by an LLM is wrong? I don't think it would do me any good. I wish people would stop giving over their writing (or other things) completely to LLMs too, but I can't make them.
mind boggles, issue is they're swamped with AI slop and high number of findings, they're using AI assistance operated by a 3rd party to handle researcher submissions so many legitimate findings slip through the cracks.
That's unfortunate. They need to do some kind of triage then, I hope this doesn't mean that they're constantly busy now with equally bad or worse bugs, but I guess it wouldn't be too surprising.
False negative? I honestly don't know what we can do about it. If this is a real issue, maybe another llm will rediscover it and it eventually will get triaged right?
True, I should have written they misclassified it, should it work as advertised. If Google knows something that makes it not an issue, hopefully they'll let us know.
Ironic comment from someone who literally just submitted an AI slop report and went so far as to give it a website and cutsey name to attempt to feign legitimacy and skill behind the "researcher."
The "if" is doing a lot of heavy lifting. Can it do what it claims to do? LLMs are always hallucinating that they've found the most severe bug in software history.
Good point, I don't know! That's why I formulated it this way. Edit: I guess what I'm trying to say is, with security relevant things it might do no harm to be a bit more credulous when it comes to initial reports. (In theory, no idea how to best handle the growing flood of LLM generated stuff. Pointing LLMs at each other doesn't seem great.)
> LLMs are always hallucinating that they've found the most severe bug in software history.
That is a function of the training data/method, like many of AI's problems. This doesn't stop it being a problem of course, but it shouldn't be a surprise.
Big bugs, like heartbleed, over the years have had breathy websites going over how serious the problem is because the problem was that serious, so the models associate that sort of wording with bug reports. Less serious bugs don't get the same excited treatment, repeated in many many places, so more measured descriptions figure in the training data relatively less.
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a patch was pushed to AOSP in October:
https://android.googlesource.com/platform/frameworks/opt/tel...
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:
https://grapheneos.org/releases#2026072900
Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.
I see, that's good to hear!
Why are you believing an entirely Claude generated webpage?
My previous question does not indicate more belief than that it might be true, so I can't answer you there. Should I adopt the belief any information put into words by an LLM is wrong? I don't think it would do me any good. I wish people would stop giving over their writing (or other things) completely to LLMs too, but I can't make them.
A wordpress page would be more believable, right?
mind boggles, issue is they're swamped with AI slop and high number of findings, they're using AI assistance operated by a 3rd party to handle researcher submissions so many legitimate findings slip through the cracks.
As far as I can tell the next ASB will fix this issue... maybe they simply forgot to tell you :/
EDIT: actually already fixed in https://review.lineageos.org/c/LineageOS/android_frameworks_...
There's yet another PDU fixup that stems from negative index
That's unfortunate. They need to do some kind of triage then, I hope this doesn't mean that they're constantly busy now with equally bad or worse bugs, but I guess it wouldn't be too surprising.
They triaged them - that's why it gets wontfix.
False negative? I honestly don't know what we can do about it. If this is a real issue, maybe another llm will rediscover it and it eventually will get triaged right?
True, I should have written they misclassified it, should it work as advertised. If Google knows something that makes it not an issue, hopefully they'll let us know.
I’m certain others have found the same bug, I’d like an answer too, hence the post.
Ironic comment from someone who literally just submitted an AI slop report and went so far as to give it a website and cutsey name to attempt to feign legitimacy and skill behind the "researcher."