Lots of new stable kernels

But apparently recent kernels panic after 10000 oopses (https://lore.kernel.org/all/20221107201317.324457-1-jannh...), so just running the null pointer dereference ten thousand times is a DoS. And the reason for this is that "harmless" null pointer dereferences commonly increment a counter such as a reference count or the number of holders of a read lock, and if that counter overflows to zero, then an exploit becomes possible. Which seems like a fair argument to me.

At my day job where I'm a sysadmin and an incident responder, I would absolutely count a DoS that takes down an entire running kernel as a security issue: if our systems shut down, we're definitely failing to make money, we might be unable to cancel orders or otherwise communicate with others to get us out of a position where we're losing money, and we're probably breaking contractual commitments to our customers. It's certainly not the highest risk - specially since, if you're at the point where you can attack our kernels, you probably have a form of userspace access we should already be deeply concerned about - but it's definitely on the list somewhere. Hurricanes and pandemics are also "only" DoSes to our business but we still made extensive plans to keep things running through those.

---

I think I see one obviously invalid CVE on this list, CVE-2023-52472: "Static checkers insist that the mpi_alloc() allocation can fail so add a check to prevent a NULL dereference. Small allocations like this can't actually fail in current kernels, but adding a check is very simple and makes the static checkers happy." (The only argument I can see is that it might fail in a downstream kernel that changes how memory allocation works, but if you're going to count the theoretical possibility of downstreams changing things, the entirety of your unchanged code is already a vulnerability.)

Everything else looks like an actual vulnerability with nonzero (though perhaps low) impact - including one that I clicked on because it didn't sound like a vulnerability at all from a subject line but turns out to be reported by the Zero Day Initiative.

Nope, it just shows they care about security. You can't forget about it when comes to Windows or FreeBSD. They're [in]security disasters.

That may very well be the case but the process here appears to be about scoring political points by overwhelming the CVE process with a lot of filings and then point at it and say see, this is broken instead of an introspective effort to actually address security disclosure issues that the kernel has long suffered from.