In 2024, the Linux kernel became its own Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA), formalizing how kernel vulnerabilities are identified and tracked. We analyze the anatomy and dynamics of kernel CVEs using metadata, associated commits, and patch latency to understand what drives patching. Results show that severity and Common Vulnerability Scoring System (CVSS) metrics have a negligible association with patch latency, whereas kernel recency is a reasonable predictor in survival models. Kernel developers fix newer kernels sooner, while older ones retain unresolved CVEs. Commits introducing vulnerabilities are typically broader and more complex than their fixes, though often only approximate reconstructions of development history. The Linux kernel remains a unique open-source project -- its CVE process is no exception.

翻译：2024年，Linux内核成为其自身的通用漏洞披露（CVE）编号机构（CNA），正式确立了内核漏洞的识别与追踪机制。本研究通过分析内核CVE的元数据、关联提交记录及补丁延迟，深入探究驱动漏洞修复的关键因素。结果表明：漏洞严重程度与通用漏洞评分系统（CVSS）指标对补丁延迟的影响微乎其微，而在生存模型中，内核版本的新旧程度可作为有效的预测指标。内核开发者倾向于优先修复较新版本的内核，而旧版本内核中未解决的CVE往往持续存在。引入漏洞的代码提交通常比修复提交涉及更广的范围和更高的复杂度，尽管这些提交往往只是开发历史的近似重构。Linux内核始终是一个独特的开源项目——其CVE处理流程亦不例外。