i'm pretty sure the kernel itself does that to themselves too. basically there's so much code in the kernel that if any bug, even if small, could possibly under a specific configuration result in some device out there having its security weakened, they prefer to be on the safe side and assign a cve.

Well more book work, filling the cve database and bureaucracy. That is why. 😳😩

i mean it makes sense to me, a vulnerability is a vulnerability regardless of whether it has been exploited or not

It’s because over the last decade the understanding and tools to take advantage of a bunch of small seemingly insignificant exploits in order to gain privileged access have become widespread.

It’s the flip side of not trusting things written in rust to be effectively more secure just because it prevents someone from sticking their thumb between their fore and middle fingers and declaring they “got your stack”.

I love insecure kernels. I actually want the bad guys to win the race against security. Only bad guys should using AI. Debian shouldnt be allowed to use AI to keep up with them.

Going to go out on a limb and say that is the pattern with every single OS at the moment. Itll taper off eventually, but there is a lot of technical debt and human slop to clean up for a bit, then things should settle down.