@kernellogger That's kind of a "if a tree falls in a forest and no one hears it, does it make a sound?" type of question, right?

Yes, if no one tells us that a specific issue/bugfix/whatever should have a CVE, and it doesn't get backported to stable (which will automatically trigger the review for CVE assignment), then you are correct, nothing will be assigned as obviously, no one noticed it.

So there is no sound :)