I mean, yes, the incentives are in fact such that sitting on a potentially exploitable bug is better for a security researcher than patching it early. Like, if

I mean, yes, the incentives are in fact such that sitting on a potentially exploitable bug is better for a security researcher than patching it early. Like, if you have a root priv escalation, that can potentially get you a bug bounty from various hosted AI sandboxes, CI sandboxes, an android app sandbox escape, and probably a few more. If you have a probably-not-exploitable kernel crash, you get a CVE at best, and possibly not even that. What do you propose we do, should google assume all kernel bugs are potential exploits and give Linus $100k per commit, making him the richest man on earth?