@vegard @kernellogger @larsmb @gregkh @pavel I am pretty sure there are scripts involved here, look at Pavel's example.

EDIT: Also on the 'go nuclear' point, the original email literally states 'the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team."

That very much speaks to going nuclear, every single 'bug fix' (however you want to define that, autosel for instance blurs lines) is likely to be quite a few. And given the use of scripts in stable process highly likely to be at least partially automated.