CVE

> I assumed that a supported kernel would include fixes for known CVE's

I think the work they've been putting in on tracking bug fixes with security implications has helped make plain the simple truth that this _isn't_ happening, people aren't backporting _all_ known fixes and applying them to older kernel.org LTS releases, which is something the core kernel devs are intimately aware of but have had miserable luck in communicating with downstream developers over the decades. Issuing their own CVE tracking has lifted the wool off some people's eyes as to the real state of the kernel.