I'm not sure how the Linux kernel handles these, but in some projects, this is intentional, the goal being to land the fix and make everyone safe before knowledge of how to exploit the bug is widely known.

Of course, sometimes just fixing up code for stability reasons may close a security hole that isn't really known or understood yet.

Not sure which was happening here.