The Linux kernel developer team assigns Common Vulnerabilities and Exposure (CVE) numbers to identify and catalog security vulnerabilities that have been fixed in the kernel. As part of the normal stable release process, kernel changes that are potentially security issues are identified by developers responsible for CVE number assignments and have CVE numbers automatically assigned to them. These assignments are published on the linux-cve-announce mailing list on a frequent basis.
The kernel's CVE assignment team deliberately takes an overly cautious approach when determining which bugfixes warrant CVE number assignments. This caution stems from the kernel's unique position within system architectures where, as the documentation states, 'almost any bug might be exploitable to compromise the security of the kernel.' However, the potential for exploitation is frequently not apparent when a bug is initially fixed and patched. Because of this uncertainty, the team assigns CVE numbers to any bugfix they identify as having potential security implications, regardless of whether active exploitation has been demonstrated.
Users of Linux systems must determine for themselves whether a specific CVE applies to their particular setup. As the Linux kernel documentation explicitly notes, 'as the Linux kernel can be used in many different ways, with many different ways of accessing it by external users, or no access at all, the applicability of any specific CVE is up to the user of Linux to determine.' Furthermore, given the kernel's substantial size and complexity, 'any one system only uses a small subset of the source tree,' meaning that 'large numbers of assigned CVEs are not relevant for their systems.'