They give every released fix a CVE-number. If you use the newest released kernel of a supported branch, by definition you have no open CVEs (except those that

They give every released fix a CVE-number. If you use the newest released kernel of a supported branch, by definition you have no open CVEs (except those that other organizations manage to get assigned). If you use something older, you will have many open CVEs. Basically saying that the CVE system is useless without saying it.