Postmortem for Kernel Soundness Bug #14576

Aug 02, 2026 01:32 AM - 2 hours ago 2

2026-08-01

A soundness bug successful the Lean kernel (#14576) was reported and fixed during the week of July 27. It has had visibility connected Zulip and societal media (e.g., X, LinkedIn, and Mastodon).

What happened

On July 25, Ramana Kumar published a repository containing a sorry-free "disproof" of the Collatz conjecture, produced pinch AI assistance. It is not a valid impervious because it exploits a bug successful the kernel's handling of nested inductive types. On July 28, Kiran Gopinathan reduced it to a mini impervious of False and opened rumor #14576. We pushed a hole 1 hr aft the study (#14577). Joachim Breitner reviewed it and suggested improvements, and it was merged. New spot releases are out.

The bug: erstwhile the kernel eliminates a nested occurrence nether an inductive type T pinch parameters Ds, and these parameters are phantom (not mentioned successful constructor fields), they vanish from the generated auxiliary type and frankincense flight type checking. An ill-typed statement successful that position could beryllium utilized to make the kernel judge a impervious of False. The bug is only reachable done metaprogramming, by sending the inductive declaration to the kernel directly. The frontend checks the arguments and catches the ill-typed term. This is an implementation bug, not a spread successful Lean's meta-theory.

Why nanoda did not drawback it

The original Collatz repository besides passed a week-old type of nanoda, the main outer checker. nanoda is an independent kernel (aka proof/type checker) for Lean implemented successful Rust by Chris Bailey. The astonishing portion is that location are 2 unrelated bugs involved. The charismatic kernel had a missing cheque successful the nested inductive type support, arsenic explained above. nanoda did cheque that spot, but did not verify the type sanction successful a projection node. The nanoda bug was reported by Jeremy Chen and fixed a week earlier the Lean bug was reported. The impervious was built truthful that the look the kernel ne'er inspects is 1 that the aged nanoda accepted.

Ramana believes the timing was coincidental, but cannot norm retired that the exemplary had seen the nanoda report. Joachim projected the presumption that the timing coincidence is owed to the readiness of beardown models capable to find this bug.

The applicable consequence: checking pinch an independent kernel still works, since it required 2 chopped bugs successful 2 implementations, but users who trust connected it request existent versions of both. lean4lean is affected by the kernel bug, since its handling of inductives is simply a larboard of the reference implementation.

Verification

Mario Carneiro's lean4lean is simply a Lean formalization of Lean's type mentation together pinch a impervious that the kernel implements it. The activity is ongoing, the impervious of consistency does not screen inductive types yet, and the to-be-verified implementation suffered from the aforesaid bug arsenic the charismatic kernel. The bug would person been recovered erstwhile attempting to reason the verification of this part.

On removing metaprogramming

One proposal successful the chat is to region aliases restrict metaprogramming truthful that this onslaught is not expressible. This is misguided. The elaborator is untrusted by design. Soundness cannot dangle connected an untrusted constituent refusing to build a bad term. An attacker who wants to taxable a malicious impervious tin besides constitute .olean files straight aliases modify memory, some of which bypass the elaborator entirely. The kernel has to cull ill-typed declarations connected its own, successful its ain process. This separation and isolation of concerns is 1 of the main advantages of impervious terms.

What the FRO is doing

Regression tests for the exploit, and for a related non-uniform-parameter lawsuit raised by Arthur Adjedj, are successful the Kernel Arena.
A follow-up PR (#14582) makes the kernel cheque that the parameters of a nested occurrence really behave arsenic parameters, alternatively than only re-type-checking them.
Daniel Selsam astatine OpenAI assisted the Lean FRO pinch an AI specialized successful cybersecurity, and recovered different programming mistakes successful the Lean kernel. All of them person been fixed. All of them were caught by nanoda. These bugs are besides only reachable done metaprogramming. PRs: #14607, #14608, #14609, #14613, #14615, #14616.
We person besides hardened kernel invariants. PRs: #14621, #14631, #14632.
comparator.live now runs nanoda by default, and nanoda is tracked regular truthful lean-eval and comparator enactment existent aft upstream fixes.
We are reaching retired to and supporting experts who tin find further bugs, create caller kernels, and activity connected the mentation aliases connected verified kernels.