I don't doubt it. I also heard that when a Linux dev find a bug that might be a vulnerability, they often don't bother adding it to the CVE database (and say as

I don't doubt it. I also heard that when a Linux dev find a bug that might be a vulnerability, they often don't bother adding it to the CVE database (and say as much in discussions with the other kernel devs) which casts doubt on the usefulness of counting CVEs as a way to estimate how secure Linux is.