Simone Margitelli’s post on the find
Margitelli posted a screenshot that implies he submit this bug to Canonical and Red Hat, who rated the vulnerability to have a CVSS of 9.9. If this is true, this bug would be more critical than the infamous Heartbleed, Spectre, and Meltdown exploits. Information is really limited right now about this bug, and also somewhat contradictory. I cannot find a public statement from Red Hat or Canonical confirming the existance of this bug, but have yet to deny it. This is typical for an exploit of this magnitude. However, according to Security Online, both insitutions have confirmed its severity.
Full disclaimer, this thing could be totally overhyped/overblown right now. Its going to take a few weeks before all the information comes out. It wouldn’t be the first time a vulnerability has been overhyped to pressure the dev into fixing it. In the mean time, Linux users should make sure to keep their systems up to date.
I have zero knowledge about the details and processes involved in security issue disclosure and even I get the feeling something is off about Margitelli’s post.
He can let his findings speak for themselves when they are responsibly disclosed (and then start the sensationalism).