skip to content

Jenny Qu

I measure how long bugs survive in other people's code. Occasionally I shorten one.

nowbuilding something new, in stealth. ask me again in a year.

fixescve · age of the bug · the fix

2026-04CVE-2026-5298618.1 yrnetfilter: nf_conntrack_sip: don't use simple_strtoul
2026-03CVE-2026-3890hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop · cve reserved
2026-03CVE-2026-2345620.0 yrnetfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
2026-03CVE-2026-2345520.0 yrnetfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
2026-03CVE-2026-41254cmslut.c: integer overflow in CubeSize (check came after the multiplication)
2026-03CVE-2026-315252.6 yrbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
2026-03CVE-2026-434536.1 yrnetfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()

everything else: linux, qemu, ffmpeg, ghostscript, mupdf, libtiff, little-cms, libpng, mihomo →

research

measurement125,183 bug-fix pairs across twenty years of kernel history. Median survival 0.7 years, mean 2.1, and 13.5% last past five.kernel-vuln-data · kernel-archaeology
detectionVulnBERT. 91.4% recall at 5.9% false positive over 650K commits on a strict temporal split. Contrastive learning ran beautifully on 4K samples and returned NaN at 162K.weights

talks

2026-04BugBash 2026How long Linux kernel bugs actually hide · 9 min
2026-03[un]prompted 2026Why most ML vulnerability detection fails

writing