The work is the “cred”. Knowing that somebody found a kernel RCE lets me know they’ve done interesting security work in the kernel space. It doesn’t matter whet

The work is the “cred”. Knowing that somebody found a kernel RCE lets me know they’ve done interesting security work in the kernel space. It doesn’t matter whether or not they had a CVE assigned for that work. PRs and CVEs are mechanisms for interacting with work. They’re not status symbols, they’re not “cred”.