The linux-distros mailing list lets someone who found a serious security issue in open source software warn several distribution vendors privately before it goes public. The maximum embargo is 14 days, shorter is preferred, and the reporter must post details to oss-security once the issue is public.
What the list is for
According to the list's published rules, it is for non-public security issues in open source software that will become public very soon, so that several distribution vendors can prepare fixes at once. Issues that are already public, or will be made public immediately, go to oss-security instead.
It is not a place for every bug. The rules say medium or high severity issues belong on the list, and low severity issues should go to oss-security.
The embargo limit
The rules state the maximum acceptable embargo period is 14 days. Embargoes shorter than 7 days are preferred, 1 day is the reasonable minimum, and in rare extreme cases a few hours of notice may help.
That is much shorter than the 90 day deadlines many researchers use for vendors. The difference is the audience. The list coordinates packaging and release across distributions that already have a fix or can build one quickly. See disclosure deadlines compared.
What a report must include
- A tentative public disclosure date and time, proposed by the reporter.
[vs]in the subject line, or the message will likely be rejected.- PGP encryption, preferably to the list's key, with encrypted attachments sent as PGP/MIME.
- Alphanumeric attachment file names (dots, minus signs and underscores allowed but not first).
The rules warn that headers such as From and Subject are not encrypted, so keep sensitive detail out of the subject. If there is no response within 48 hours, send a follow-up to confirm receipt.
Before you write to the list
Notify upstream projects and affected vendors first when possible, and confirm they accept the maximum embargo. For Linux kernel issues, the rules say to notify the kernel security team first, wait for the fix, then notify linux-distros or oss-security.
After disclosure
The rules require the original reporter to post a sufficiently detailed description to oss-security once the issue is public, so people who are not on the list can also fix it. That step is easy to forget when the embargo ends in a rush.
What it means for users of open source
If you run a distribution package, the embargo is the reason a fix can land on the same day as the public notice. If you ship your own build, you only learn on disclosure day, so watch the advisories for your dependencies. Safeguard's zero-day discovery and SBOM scanning help identify which of your projects contain an affected package once details are public. For a response plan see how to handle a zero-day vulnerability.
Quick check
Can an embargo be longer than 14 days on this list?
Not according to the list rules. 14 days is the maximum acceptable period.
Do I need to be a distribution maintainer to report?
The sources describe the list as for sharing with distribution vendors. Reporters send to it. Check the list rules for current membership and contact details before writing.
Sources
Last reviewed: 19 October 2026.
