Attaching CVE-ID to specific kernel fixes

Attaching CVE-ID to specific kernel fixes

[Hardik Gohil]

Hello Greg,

I had a query regarding CVE fixes for LTS kernels. I noticed that
while fixes are backported to LTS kernels, the corresponding CVE ID is
sometimes not included in the patch.

May I know the reason for not adding the CVE ID to these fixes?
Wouldn’t it be a good practice to include the CVE ID in the patch, as
it would make it easier to identify and track the security fixes?

Any views on this from the community?

Regards,
Hardik

Re: Attaching CVE-ID to specific kernel fixes

[Greg KH]

On Fri, Sep 11, 2026 at 04:50:40PM +0530, Hardik Gohil wrote:
> Hello Greg,
> 
> I had a query regarding CVE fixes for LTS kernels. I noticed that
> while fixes are backported to LTS kernels, the corresponding CVE ID is
> sometimes not included in the patch.

Yes, because it's not needed.

> May I know the reason for not adding the CVE ID to these fixes?

We just keep the identical changelog from what is in mainline.

> Wouldn’t it be a good practice to include the CVE ID in the patch, as
> it would make it easier to identify and track the security fixes?

That's not what the kernel changelog is for, that is what the kernel cve
vulns.git repo is for.  Some CVE ids change over time, and some are
rejected and the like.  To attempt to keep that all up to date in the
kernel source tree itself without rewriting history would be impossible.

thanks,

greg k-h