Embed Notice

@vathpela @vegard @gregkh
The corollary of "security bugs are bugs" is "bugs are security bugs". Without an omniscient view of all Linux deployments and the associated reachability analysis, the objective security impact of a behavioral weakness cannot be assessed. And this is especially true given that (even minor) flaws are commonly chained together to build exploits.

This new process won't be perfect, but it'll be a whole lot closer to reality than the prior process: assigning no CVEs. :)