[bonzini]

It's true that important or critical fixes (embargoed or not) are applied to RHEL before CentOS Stream. Forgetting to apply it seems unlikely because it would be marked as a regression in the next minor release of RHEL. Usually all the red tape is ready and you only need to "git push" as soon as the RHEL packages are shipped.

If not embargoed, however, they are still applied to Fedora first. But most fixes of that severity are embargoed anyway and therefore the patches simply cannot be applied to public source trees without breaking the embargo rules.