> _any_ bugfix is assigned a cve

Any patch that is back ported to a stable kernel, indiscriminately. And they have also started assigning CVSS scores with the same kind of malicious compliance.

Take for example, this patch in the device mapper RAID code:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

After back porting to stable, it got assigned CVE-2026-89558 (which is in this list), and a CVSS score of 9.8:

https://git.kernel.org/pub/scm/linux/security/vulns.git/tree...

Reasoning behind it being that theoretically, a RAID could be accessible over the network via NFS, iSCSI, etc... so if it gets corrupted, the buggy code path in the recovery (CVE-2026-89558) is effectively triggered over the network.