> the Linux kernel has 849 overflow and memory corruption CVEs 4 years ago, they had 40 memory-corruption-related CVEs. Their actual vulnerability count hasn'

> the Linux kernel has 849 overflow and memory corruption CVEs 4 years ago, they had 40 memory-corruption-related CVEs. Their actual vulnerability count hasn't increased by 2122% over 4 years – rather, they've become a CVE numbering authority and have started self-assigning CVEs even when there is no evidence of a vulnerability: > Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assigns CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team. <https://lwn.net/ml/linux-kernel/2024021430-blanching-spotter-c7c8@gregkh/ https://lwn.net/ml/linux-kernel/2024021430-blanching-spotter...> Having a huge number of self-issued CVEs is a policy decision on the part of the Kernel maintainers.