Security Embargo

A security embargo is the agreed period during which a vulnerability, and usually its fix, is known to a limited group and withheld from the public. It begins when the maintainer of the affected software shares the details privately with downstream distributors and ends on the coordinated disclosure date, when the advisory, the fix, and the distributors' packages are published together. For the teams running the software, an embargo that holds means the fix is already in their update channel on the day they learn the vulnerability exists. Everyone who receives the information agrees not to publish, discuss, or ship anything that reveals it before that date.

What is a security embargo?

The embargo is the mechanism that makes coordinated disclosure work. An upstream project fixes its own current release, but organizations that get the software from a Linux distribution or a vendor run the version that distributor packaged, often an older one. Those packages have to be built, tested, and staged before the disclosure date, or users will learn about a vulnerability with no fix available for the version they run. The embargo buys the time for that work.

Published policies cap how long an embargo can run, so that it can't become an excuse to sit on a fix. The linux-distros list accepts embargoes of no more than 14 days and prefers fewer than 7. The Linux kernel security team allows up to 7 calendar days, extended to 14 only for critical bugs.

Who is inside the embargo is deliberately limited: the reporter, the project's security team, and distributors on the relevant pre-notification list. Every additional party is a possible leak, so the circle is kept small and the period short.

Why security embargoes matter

For users of the software, an embargo that holds means that on the day they learn about a vulnerability, dnf update already has the fix. That is the best case a security program can hope for: an inventory check and a rollout, not an emergency.

For distributors, the embargo period is when the work happens. A distribution that ships an older version has to backport the fix to it, build for every architecture and every module stream, run its tests, and sign the packages, all before the clock runs out and without revealing what it is working on.

What happens when an embargo breaks

An embargo can end early in three ways:

• A leak. Someone posts details to a forum, a mailing list, or social media.
• An early publication. A demonstration, a public commit, or a patched build appears before the date. A patched build reveals as much as an advisory, because the diff between the old and new package shows what was fixed. The linux-distros list treats a fix in a publicly accessible repository as public for this reason.
• Independent discovery. Someone else finds the same flaw during the embargo. The Linux kernel security team now asks reporters to treat any bug found with AI assistance as public, because such bugs surface across several researchers at once.

A broken embargo turns the disclosure date into a race, decided by how quickly each distributor can finish builds for every version its customers run. Nathan Blackham describes that race for PHP2Shell in Patch PHP2Shell now and prepare for the next AI-found CVE, and our guide on AI-found vulnerabilities covers the engineering it takes.

Embargo versus related terms

Term	What it covers
Security embargo	The private period before disclosure, and the agreement not to publish during it
Coordinated disclosure	The overall practice of agreeing when a vulnerability and its fix go public
Responsible disclosure	An older name for coordinated disclosure, still in use
Zero-day	A vulnerability being exploited before a fix is available, with or without a prior embargo
Pre-notification	The act of sharing an embargoed fix with distributors, for example through a closed list such as linux-distros

Embargoes at CIQ

When CIQ receives a fix under embargo as the distributor of Rocky Linux from CIQ Pro (RLC Pro), its engineers use the period to build and test packages for RLC Pro and RLC Pro LTS releases, including backports for versions upstream no longer maintains. The CIQ security page describes how CIQ handles a vulnerability report, what it does with issues under embargo, and what it publishes after an embargo lifts.