Linux CVE assignment process
Summary
The Linux Kernel Monkey Log explains how the Linux kernel CVE assignment process works, including how vulnerabilities are defined, how commits are reviewed for CVEs, and how CVE records are created and updated. It covers the roles of the core reviewers, the tools used to classify fixes, and the public nature of reviews, as well as when CVEs are issued and how disputes are handled. It also explains why only a subset of kernel fixes become CVEs, the handling of severity, and the workflow from patch to CVE in a high-volume release environment.