18-year-old bug in OpenAI infrastructure: How a minor Linux kernel flaw survived since 2008

18 years in the shadows: The history of a bug that spanned eras

In the tech world, where software evolves at breakneck speed, it is hard to believe that a serious bug could remain undetected for nearly two decades. Yet, in May 2026, OpenAI announced the fix for an 18-year-old infrastructure bug that had been present in their systems since 2008. The issue concerned the mechanism for generating core dumps—files containing a process's memory image at the time of a crash, which are crucial for system diagnostics.

The bug was not the result of an advanced zero-day vulnerability, but rather a combination of outdated configuration and flawed assumptions. Specifically, it involved the Linux kernel parameter fs.suid_dumpable, which controls whether processes with the SUID bit set can generate core dumps. In 2008, in Linux kernel 2.6.26, the default value for this parameter was set to 2—which was theoretically intended to improve functionality, but in practice, created a potential security risk.

Why core dumps?

Core dumps are an inherent part of Linux system diagnostics. When a process crashes, the system generates a file containing its memory state, allowing developers to analyze the root cause. In production environments, where stability is critical, core dumps are often the only source of information regarding critical failures. However, it is precisely this role that makes incorrect configuration a potential vector for serious data leaks.

In OpenAI's case, the problem was that core dumps of processes with elevated privileges (e.g., those running as root) were being saved with incorrect file permissions. Instead of the secure 600 (accessible only to the owner), the files had permissions of 640, which allowed other users or processes on the system to access them. In extreme cases, this could lead to the leakage of sensitive data—from passwords to fragments of AI model memory.

How did the bug survive for 18 years?

The obvious question is: how could such a serious issue remain undetected for so long? The answer lies in a complex combination of technical and organizational factors.

1. Invisibility of the problem

The bug did not cause immediate crashes or visible system performance issues. Core dumps were generated correctly; the only difference was the file permissions—something easily overlooked in day-to-day operations. Most administrators focus on monitoring critical errors rather than the fine-grained configuration of temporary files.

2. Trust in default settings

Most Linux distributions (Ubuntu, Debian, RHEL) defaulted to fs.suid_dumpable=2, which was consistent with historical kernel behavior. Administrators often assume that default settings are secure—yet in this case, the exact opposite was true. The Linux kernel documentation had long recommended the value 0 for production environments, but this information was ignored by most distributions.

3. Complexity of dependencies

The problem involved the interaction between three key components:

• The Linux kernel (parameter fs.suid_dumpable)
• systemd-coredump (a core dump management tool introduced in 2015)
• OpenAI's initialization scripts and configuration

This complexity made the bug difficult to diagnose, as it required deep knowledge of all three layers of the system.

4. Lack of security audits

OpenAI, like many other companies, did not conduct regular security audits of kernel configurations. Parameters such as fs.suid_dumpable are rarely verified in routine reviews because they are not perceived as critical to system operation.

Discovery and repair: How did OpenAI finally catch the bug?

According to an OpenAI blog post from May 15, 2026, the bug was discovered during a routine security configuration review conducted as part of preparations for deploying new infrastructure. The security team noticed that some core dumps had unexpected permissions, which prompted a deeper analysis.

Diagnostic process

1. Initial observation: Core dumps had permissions of 640 instead of the expected 600.
2. Configuration analysis: Checking the fs.suid_dumpable parameter using sysctl revealed a value of 2.
3. Documentation review: It turned out that the value 2 was inconsistent with Linux kernel documentation recommendations.
4. Reproduction tests: Recreating the core dump generation scenario confirmed the issue.
5. Historical analysis: Tracing changes in the Linux kernel revealed that the bug was introduced in 2008.

Repair and next steps

The fix proved relatively simple—it was enough to change the parameter value to the recommended 0:

sysctl -w fs.suid_dumpable=0

To make the change persistent, OpenAI added an entry to /etc/sysctl.conf:

fs.suid_dumpable = 0

In addition to the fix itself, OpenAI also implemented a series of organizational changes:

• Regular kernel configuration audits (weekly scanning of sysctl parameters).
• Implementation of automated configuration testing tools (e.g., openscap, Lynis).
• Adjusting systemd-coredump configuration to enforce secure permissions.
• Collaboration with the open-source community to report the issue to the systemd project.

Lessons for the industry: What can we learn from this case?

The OpenAI case is not just a technical curiosity but an important lesson for the entire IT industry. Here are the key takeaways:

1. Default settings are not always secure

Many organizations assume that default Linux distribution configurations are optimized for security. However, as this case shows, default settings can be outdated or inconsistent with best practices. Administrators should regularly verify system configuration, especially in areas related to security.

2. The importance of "boring" audits

Many critical bugs result from negligence in routine audits rather than advanced attacks. Regular configuration reviews, even of seemingly minor settings, can prevent serious issues. Remember that security is a process, not a one-time action.

3. Automation as the key to security

In large environments, manual configuration reviews are time-consuming and error-prone. Tools like openscap or Lynis allow for automated system scanning for compliance with best practices. It is worth considering their implementation, especially in large-scale infrastructures.

4. Collaboration with the open-source community

OpenAI shared its experience publicly, which is a good practice for the entire industry. Reporting issues to upstream projects (e.g., Linux kernel, systemd) allows for improving security for all users. Remember that open-source is an ecosystem where everyone can contribute to its development.

5. Education and awareness

Many administrators are unaware of the existence of parameters like fs.suid_dumpable and their impact on security. Linux system security training should cover key kernel parameters and their configuration. This knowledge can prevent similar problems in the future.

Similar cases: Bugs that survived for decades

The OpenAI case is not isolated. IT history is full of examples of bugs that remained undetected for years or even decades. Here are a few:

• Bug in sudo (CVE-2021-3156): A 10-year-old vulnerability allowing privilege escalation, discovered in 2021. The problem involved a heap-based overflow in the sudo code and could lead to root access by unauthorized users.
• Bug in procps-ng (CVE-2018-1124): A 20-year-old vulnerability in process monitoring tools (top, ps) that allowed for DoS attacks or data leakage.
• Bug in glibc (GHOST, CVE-2015-0235): A 15-year-old vulnerability in the glibc library, allowing remote code execution via a buffer overflow in the gethostbyname() function.
• Bug in Bash (Shellshock, CVE-2014-6271): A 25-year-old vulnerability in the Bash interpreter, allowing remote code execution via improper handling of environment variables.

All these cases show that even widely used and well-tested tools can contain critical flaws. The key is to regularly update systems, monitor configurations, and proactively test for security.

What's next? Recommendations for administrators

Based on the analysis of the OpenAI case and similar incidents, here are practical recommendations for Linux system administrators:

1. Conduct a kernel configuration audit

Check key sysctl parameters for compliance with best practices. Pay special attention to:

• fs.suid_dumpable (should be set to 0 in production environments)
• kernel.dmesg_restrict (should be set to 1 to restrict access to kernel logs)
• net.ipv4.conf.all.rp_filter (should be set to 1 to prevent spoofing attacks)

2. Automate configuration monitoring

Implement automated system scanning tools such as:

• openscap (security standard for Linux systems)
• Lynis (security auditing tool)
• Ansible (for configuration automation)

3. Test core dump generation

Simulate process crashes and check how the system generates core dumps. Ensure that:

• Files have appropriate permissions (600).
• Core dumps of privileged processes are not accessible to unauthorized users.
• Tools like coredumpctl work correctly.

4. Monitor file permissions

Regularly check the permissions of temporary files and logs. Tools like auditd can help monitor access to sensitive files.

5. Educate the team

Organize Linux system security training, focusing on:

• Key kernel parameters and their impact on security.
• Configuration best practices.
• Automation and monitoring tools.

Summary: Why is this case important?

The OpenAI case is not just a story about an 18-year-old bug, but a warning for the entire IT industry. It shows how easy it is to overlook critical issues when relying on default settings and routine procedures. At the same time, it highlights the importance of regular audits, automation, and collaboration with the open-source community.

In a world where IT infrastructure is becoming increasingly complex and cyber threats are evolving rapidly, a proactive approach to security is crucial. The OpenAI case reminds us that even the smallest configuration details can have serious consequences—and that it is never too late to start verifying them.

If you manage Linux infrastructure, now is a good time to audit your configuration. You might find that your systems also have hidden, years-old vulnerabilities—and that fixing them is simpler than you think.

"Security is not a product, but a process. Even the best-designed systems can contain bugs if they are not regularly verified and updated."

- Quote adapted from IT security experts