The distros and linux-distros lists are private mailing lists that connect open source maintainers with distribution security contacts before a fix is public. The maximum embargo is 14 days, and shorter than 7 is preferred. They are for non-public issues about to become public, not for issues that are already public.
What the lists are
The oss-security wiki describes two mailing lists of operating system distribution security contacts. The linux-distros list has representatives from a range of Linux distributions. The broader distros list adds some other operating systems. A reporter sends an email to the list that matches who should be informed.
When to use it
The policy page is firm that posting brings responsibilities and should be read first. Key points:
| Situation | Where to post |
|---|---|
| Issue not yet public and will be soon | linux-distros or distros, with a proposed disclosure date |
| Issue already public, or about to be public right away | oss-security, instead of, not in addition to, the private lists |
| Fix already in a public repository | Generally treated as public, so post to oss-security |
| Linux kernel issue | Tell the kernel security team first, wait for the fix, then post |
The page says to consider notifying the upstream project and other affected vendors first, so that fixes are ready for the distributions and everyone agrees to the maximum embargo.
The embargo limit
The maximum acceptable embargo for these lists is 14 days. The page asks reporters not to request longer, says periods shorter than 7 days are preferable, and calls one day a reasonable minimum. In extreme cases even a few hours of notice may help.
What to send
The page asks for the report to go to the list address with the four character marker in the subject line or the message will most likely be rejected. It also asks you to propose a tentative public disclosure date and time, and to follow up if there is no reply within 48 hours. Messages can be plain, PGP/MIME or inline PGP. Headers, including the subject, are not encrypted, so keep sensitive detail out of the subject.
The page also says to request a CVE ID alongside, but not to use the lists just to get one.
Steps for a maintainer
- Confirm the issue affects open source software that distributions ship.
- Have a fix ready, or close to ready, before you write.
- Pick a disclosure date within the limit, ideally under a week.
- Read the current list policy fully before posting.
- Send one clear message with affected versions, impact and the proposed date.
- Publish your advisory and notify oss-security when the embargo ends.
What consumers gain
If your software comes from a distribution, this is the route that lets the vendor ship a fix on the day of disclosure. It is worth checking how your distribution handles updates.
Try it yourself
Click through it at your own pace, or open it full screen. Watch an issue move from unknown to public, and think about who needs to know before that point.
Quick check
Can I ask for a 30 day embargo?
The policy says the maximum is 14 days and asks reporters not to request longer.
Should I post to both lists and oss-security?
If the issue is public or about to be, post to oss-security instead of the private lists.
Is it a way to get a CVE?
The page says not to abuse the lists solely to get one.
How Safeguard helps
Safeguard's zero-day discovery and dependency scanning watch for newly published issues in the components you actually use, and reachability analysis helps you judge whether your code touches the affected path. Policies and gates can hold a risky version out of a release. Autonomous remediation can open fix pull requests; it is off by default, with every category on Manual. Start with the free scan.
Sources
- Openwall, Operating system distribution security contact lists: list policy and embargo rules. Fetched 19 October 2026.
Last reviewed: 19 October 2026.
