Linux Kernel Recency Matters, CVE Severity Doesn't, and History Fades
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866916044174524416 |
|---|---|
| author | Przymus, Piotr Weiner, Witold Rykaczewski, Krzysztof Kudrjavets, Gunnar |
| author_facet | Przymus, Piotr Weiner, Witold Rykaczewski, Krzysztof Kudrjavets, Gunnar |
| contents | In 2024, the Linux kernel became its own Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA), formalizing how kernel vulnerabilities are identified and tracked. We analyze the anatomy and dynamics of kernel CVEs using metadata, associated commits, and patch latency to understand what drives patching. Results show that severity and Common Vulnerability Scoring System (CVSS) metrics have a negligible association with patch latency, whereas kernel recency is a reasonable predictor in survival models. Kernel developers fix newer kernels sooner, while older ones retain unresolved CVEs. Commits introducing vulnerabilities are typically broader and more complex than their fixes, though often only approximate reconstructions of development history. The Linux kernel remains a unique open-source project -- its CVE process is no exception. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2601_22196 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Linux Kernel Recency Matters, CVE Severity Doesn't, and History Fades Przymus, Piotr Weiner, Witold Rykaczewski, Krzysztof Kudrjavets, Gunnar Software Engineering Cryptography and Security In 2024, the Linux kernel became its own Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA), formalizing how kernel vulnerabilities are identified and tracked. We analyze the anatomy and dynamics of kernel CVEs using metadata, associated commits, and patch latency to understand what drives patching. Results show that severity and Common Vulnerability Scoring System (CVSS) metrics have a negligible association with patch latency, whereas kernel recency is a reasonable predictor in survival models. Kernel developers fix newer kernels sooner, while older ones retain unresolved CVEs. Commits introducing vulnerabilities are typically broader and more complex than their fixes, though often only approximate reconstructions of development history. The Linux kernel remains a unique open-source project -- its CVE process is no exception. |
| title | Linux Kernel Recency Matters, CVE Severity Doesn't, and History Fades |
| topic | Software Engineering Cryptography and Security |
| url | https://arxiv.org/abs/2601.22196 |