Linux Kernel Recency Matters, CVE Severity Doesn't, and History Fades

• URL: http://arxiv.org/abs/2601.22196v1
• Date: Thu, 29 Jan 2026 12:45:35 GMT
• Title: Linux Kernel Recency Matters, CVE Severity Doesn't, and History Fades
• Abstract summary: In 2024, the Linux kernel became its own Common Vulnerabilities and Exposures and Numbering Authority (CNA)<n>We analyze the anatomy and dynamics of kernel CVEs using metadata, associated commits, and patch latency to understand what drives patching.
• Score: 2.204918347869259
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: In 2024, the Linux kernel became its own Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA), formalizing how kernel vulnerabilities are identified and tracked. We analyze the anatomy and dynamics of kernel CVEs using metadata, associated commits, and patch latency to understand what drives patching. Results show that severity and Common Vulnerability Scoring System (CVSS) metrics have a negligible association with patch latency, whereas kernel recency is a reasonable predictor in survival models. Kernel developers fix newer kernels sooner, while older ones retain unresolved CVEs. Commits introducing vulnerabilities are typically broader and more complex than their fixes, though often only approximate reconstructions of development history. The Linux kernel remains a unique open-source project -- its CVE process is no exception.

Related papers

• Anchors that Don't Lift: Understanding Supply Chain Driven Kernel Lock-In and Governance-Mediated Mitigation Strategies in SOHO Devices [9.169153006986479]
  Small Office/Home Office (SOHO) devices are widely popular, yet often attacked due to security vulnerabilities in their firmware.<n>Previous work audited the extent and impact of this issue by simple Linux version extraction and version number based vulnerability mapping.<n>We uncover actual kernel-related vulnerabilities found in 306 SOHO devices using a high-precision template-based CVE detection mechanism.
  arXiv  Detail & Related papers  (2026-06-09T17:51:26Z)
• Outrunning LLM Cutoffs: A Live Kernel Crash Resolution Benchmark for All [57.23434868678603]
  Live-kBench is an evaluation framework for self-evolving benchmarks that scrapes and evaluates agents on freshly discovered kernel bugs.<n> kEnv is an agent-agnostic crash-resolution environment for kernel compilation, execution, and feedback.<n>Using kEnv, we benchmark three state-of-the-art agents, showing that they resolve 74% of crashes on the first attempt.
  arXiv  Detail & Related papers  (2026-02-02T19:06:15Z)
• What Do They Fix? LLM-Aided Categorization of Security Patches for Critical Memory Bugs [46.325755802511026]
  We developLM, a dual-method pipeline that integrates two approaches based on a Large Language Model (LLM) and a fine-tuned small language model.<n>LM successfully identified 111 of 5,140 recent Linux kernel patches addressing OOB or UAF vulnerabilities, with 90 true positives confirmed by manual verification.
  arXiv  Detail & Related papers  (2025-09-26T18:06:36Z)
• CrashFixer: A crash resolution agent for the Linux kernel [58.152358195983155]
  This work builds upon kGym, which shares a benchmark for system-level Linux kernel bugs and a platform to run experiments on the Linux kernel.<n>This paper introduces CrashFixer, the first LLM-based software repair agent that is applicable to Linux kernel bugs.
  arXiv  Detail & Related papers  (2025-04-29T04:18:51Z)
• A Time Series Analysis of Assertions in the Linux Kernel [0.0]
  The paper empirically examines the longitudinal evolution of assertion use in the Linux kernel.<n>The use of assertions that cause a kernel panic has slightly but not substantially decreased from the kernel's third to the sixth release series.
  arXiv  Detail & Related papers  (2024-12-27T05:22:09Z)
• KGym: A Platform and Dataset to Benchmark Large Language Models on Linux Kernel Crash Resolution [59.20933707301566]
  Large Language Models (LLMs) are consistently improving at increasingly realistic software engineering (SE) tasks. In real-world software stacks, significant SE effort is spent developing foundational system software like the Linux kernel. To evaluate if ML models are useful while developing such large-scale systems-level software, we introduce kGym and kBench.
  arXiv  Detail & Related papers  (2024-07-02T21:44:22Z)
• KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities [13.479046300981832]
  Linux kernel vulnerability reproduction is a critical task in system security. It is hard to guarantee that the selected kernel version for reproduction is vulnerable. Many vulnerabilities can not be reproduced in kernels built with default configurations.
  arXiv  Detail & Related papers  (2024-04-17T06:45:05Z)
• KernelGPT: Enhanced Kernel Fuzzing via Large Language Models [8.77369393651381]
  We propose KernelGPT, the first approach to automatically synthesizing syscall specifications via Large Language Models (LLMs)<n>Our results demonstrate that KernelGPT can generate more new and valid specifications and achieve higher coverage than state-of-the-art techniques.
  arXiv  Detail & Related papers  (2023-12-31T18:47:33Z)
• Kernel Identification Through Transformers [54.3795894579111]
  Kernel selection plays a central role in determining the performance of Gaussian Process (GP) models. This work addresses the challenge of constructing custom kernel functions for high-dimensional GP regression models. We introduce a novel approach named KITT: Kernel Identification Through Transformers.
  arXiv  Detail & Related papers  (2021-06-15T14:32:38Z)
• Isolation Distributional Kernel: A New Tool for Point & Group Anomaly Detection [76.1522587605852]
  Isolation Distributional Kernel (IDK) is a new way to measure the similarity between two distributions. We demonstrate IDK's efficacy and efficiency as a new tool for kernel based anomaly detection for both point and group anomalies.
  arXiv  Detail & Related papers  (2020-09-24T12:25:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.