Every claim below was made in this piece, quoted word for word and numbered in the order the piece makes them, so you can read it there rather than take our word for it. The sentence above each quote is our reading of the claim, not their wording. Each quote was checked against a stored copy of the page at build time; where the two differ, the quote is the fact.
Their wordsPersonally, I think that filesystem corruption or data loss bug fixes should be considered a CVE fix, but until cve.org changes their policy, we can not assign CVEs for those types of fixes.
Their wordsSo any group that attempts to give a "severity score" to a Linux CVE is lying to you, UNLESS they know exactly your use case.
Our reading
NIST/NVD's assignment of CVSS scores to vulnerabilities provides a false sense of security.
Their wordsALWAYS ignore any attempt that groups such as NIST/NVD that purport to assign things like CVSS scores to a vulnerability. Those numbers are false and give companies a "fake sense of security".
Keep reading