[viraptor]

While I understand the problems raised in this post, I think they're going a bit too far. The CVEs assigned to the kernel were already specific to various parts of it. You're not running linux-x.y.z, but rather linux-x.y.z + specific config. That means vendors already needed to look at CVEs and decide what applies to them and what doesn't. It's up to NVD records to include how likely something is to be a problem and give it some description / score.

Choosing a random selection of CVEs posted so far... they look reasonable. They're actual issues and they'll potentially affect someone.

This reminds me of the cookie banners situation. Many people complain about the cookie banners being visible rather than about the companies doing things that requires them to notify you. Now if you say you care about the published vulnerabilities, you get to actually see them all. And potentially change the policies around how you worked with them. (yes, it's not a great analogy, I'm not blaming linux for having each of those vulnerabilities)

[Avamander]

> That means vendors already needed to look at CVEs and decide what applies to them and what doesn't.

So many vendors don't and it's tedious to say the least.

[throwaway11460]

Perhaps people don't care about companies doing it and they don't want to be notified about it?