{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T11:01:14Z","timestamp":1785495674205,"version":"3.56.0"},"publisher-location":"New York, NY, USA","reference-count":52,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T00:00:00Z","timestamp":1776038400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,13]]},"DOI":"10.1145\/3793302.3793364","type":"proceedings-article","created":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T10:42:54Z","timestamp":1785494574000},"page":"360-372","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Linux Kernel Recency Matters, CVE Severity Doesn\u2019t, and History Fades"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9548-2388","authenticated-orcid":false,"given":"Piotr","family":"Przymus","sequence":"first","affiliation":[{"name":"Nicolaus Copernicus University, Toru\u0144, Poland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-0849-4303","authenticated-orcid":false,"given":"Witold","family":"Weiner","sequence":"additional","affiliation":[{"name":"Nicolaus Copernicus University and Adtran Networks Sp. z o.o, Toru\u0144, Poland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4772-6330","authenticated-orcid":false,"given":"Krzysztof","family":"Rykaczewski","sequence":"additional","affiliation":[{"name":"Nicolaus Copernicus University, Toru\u0144, Poland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3730-4692","authenticated-orcid":false,"given":"Gunnar","family":"Kudrjavets","sequence":"additional","affiliation":[{"name":"Amazon Web Services, Seattle, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,31]]},"reference":[{"key":"e_1_3_3_2_2_2","volume-title":"Improving the Linux kernel with upstream contributions","author":"Meta Engineering at","year":"2015","unstructured":"Engineering at Meta. 2015. Improving the Linux kernel with upstream contributions. Retrieved October 20, 2025 from https:\/\/engineering.fb.com\/2015\/10\/05\/open-source\/improving-the-linux-kernel-with-upstream-contributions\/"},{"key":"e_1_3_3_2_3_2","volume-title":"Sloc Cloc and Code (scc). scc: v3.5.0","author":"Boyter Benjamin E.\u00a0C.","year":"2025","unstructured":"Benjamin E.\u00a0C. Boyter. 2025. Sloc Cloc and Code (scc). scc: v3.5.0. Retrieved October 20, 2025 from https:\/\/github.com\/boyter\/scc\/"},{"key":"e_1_3_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2011.31"},{"key":"e_1_3_3_2_5_2","volume-title":"Cyber Resilience Act, Article 14\u2014Reporting obligations of manufacturers","author":"Commission European","year":"2024","unstructured":"European Commission. 2024. Cyber Resilience Act, Article 14\u2014Reporting obligations of manufacturers. Retrieved October 20, 2025 from https:\/\/www.european-cyber-resilience-act.com\/Cyber_Resilience_Act_Article_14.html"},{"key":"e_1_3_3_2_6_2","volume-title":"Cyber Resilience Act (CRA)","author":"Commission European","year":"2024","unstructured":"European Commission. 2024. Cyber Resilience Act (CRA). Retrieved October 20, 2025 from https:\/\/www.european-cyber-resilience-act.com\/Cyber_Resilience_Act_Articles.html"},{"key":"e_1_3_3_2_7_2","volume-title":"Reducing kernel-maintainer burnout","author":"Corbet Jonathan","year":"2023","unstructured":"Jonathan Corbet. 2023. Reducing kernel-maintainer burnout. Retrieved October 20, 2025 from https:\/\/lwn.net\/Articles\/952034\/"},{"key":"e_1_3_3_2_8_2","volume-title":"A turning point for CVE numbers","author":"Corbet Jonathan","year":"2024","unstructured":"Jonathan Corbet. 2024. A turning point for CVE numbers. Retrieved October 20, 2025 from https:\/\/lwn.net\/Articles\/961978"},{"key":"e_1_3_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/1162666.1162671"},{"key":"e_1_3_3_2_10_2","volume-title":"How CrowdStrike Stopped Everything","author":"Geer David","year":"2024","unstructured":"David Geer. 2024. How CrowdStrike Stopped Everything. Retrieved October 20, 2025 from https:\/\/cacm.acm.org\/news\/how-crowdstrike-stopped-everything"},{"key":"e_1_3_3_2_11_2","volume-title":"Common Vulnerability Scoring System version 4.0: Specification Document","author":"Group CVSS Special\u00a0Interest","year":"2024","unstructured":"CVSS Special\u00a0Interest Group. 2024. Common Vulnerability Scoring System version 4.0: Specification Document. Retrieved December 6, 2025 from https:\/\/www.first.org\/cvss\/v4-0\/specification-document"},{"key":"e_1_3_3_2_12_2","volume-title":"13th USENIX Workshop on Cyber Security Experimentation and Test, CSET 2020, August 10, 2020","author":"Householder Allen\u00a0D.","year":"2020","unstructured":"Allen\u00a0D. Householder, Jeff Chrabaszcz, Trent Novelly, David Warren, and Jonathan\u00a0M. Spring. 2020. Historical Analysis of Exploit Availability Timelines. In 13th USENIX Workshop on Cyber Security Experimentation and Test, CSET 2020, August 10, 2020, Tamara Denning and Tyler Moore (Eds.). USENIX Association. https:\/\/www.usenix.org\/conference\/cset20\/presentation\/householder"},{"key":"e_1_3_3_2_13_2","doi-asserted-by":"crossref","unstructured":"Ayelet Israeli and Dror\u00a0G Feitelson. 2010. The Linux kernel as a case study in software evolution. Journal of Systems and Software 83 3 (2010) 485\u2013501. doi:10.1016\/j.jss.2009.09.042","DOI":"10.1016\/j.jss.2009.09.042"},{"key":"e_1_3_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-13734-6_6"},{"key":"e_1_3_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.5555\/2487085.2487111"},{"key":"e_1_3_3_2_16_2","doi-asserted-by":"crossref","unstructured":"E.\u00a0L. Kaplan and Paul Meier. 1958. Nonparametric Estimation from Incomplete Observations. J. Amer. Statist. Assoc. 53 282 (1958) 457\u2013481. doi:10.1080\/01621459.1958.10501452","DOI":"10.1080\/01621459.1958.10501452"},{"key":"e_1_3_3_2_17_2","volume-title":"What Stable Kernel Should I Use","author":"Kroah-Hartman Greg","year":"2018","unstructured":"Greg Kroah-Hartman. 2018. What Stable Kernel Should I Use. Retrieved October 20, 2025 from http:\/\/www.kroah.com\/log\/blog\/2018\/08\/24\/what-stable-kernel-should-i-use\/"},{"key":"e_1_3_3_2_18_2","volume-title":"CVEs are dead, long live the CVE!","author":"Kroah-Hartman Greg","year":"2019","unstructured":"Greg Kroah-Hartman. 2019. CVEs are dead, long live the CVE!Retrieved October 20, 2025 from https:\/\/www.youtube.com\/watch?v=HeeoTE9jLjM Presented at the Kernel Recipes 2019, Paris, France, Sep 25\u201327, 2019."},{"key":"e_1_3_3_2_19_2","volume-title":"Demystifying the Linux kernel security process","author":"Kroah-Hartman Greg","year":"2023","unstructured":"Greg Kroah-Hartman. 2023. Demystifying the Linux kernel security process. Retrieved October 20, 2025 from https:\/\/www.youtube.com\/watch?v=2TZe5EROFhE Presented at the Kernel Recipes 2019, Paris, France, Sep 25\u201327, 2023."},{"key":"e_1_3_3_2_20_2","volume-title":"CVEs are alive, but no not panic!","author":"Kroah-Hartman Greg","year":"2024","unstructured":"Greg Kroah-Hartman. 2024. CVEs are alive, but no not panic!Retrieved October 20, 2025 from https:\/\/kernel-recipes.org\/en\/2024\/cves-are-alive-but-no-not-panic\/"},{"key":"e_1_3_3_2_21_2","volume-title":"Linux is a CNA","author":"Kroah-Hartman Greg","year":"2024","unstructured":"Greg Kroah-Hartman. 2024. Linux is a CNA. Retrieved October 20, 2025 from http:\/\/www.kroah.com\/log\/blog\/2024\/02\/13\/linux-is-a-cna\/"},{"key":"e_1_3_3_2_22_2","volume-title":"Linux is now a CNA","author":"Kroah-Hartman Greg","year":"2024","unstructured":"Greg Kroah-Hartman. 2024. Linux is now a CNA. Retrieved October 20, 2025 from https:\/\/social.kernel.org\/notice\/Aeroz3uO3oYwL7Y5qK"},{"key":"e_1_3_3_2_23_2","volume-title":"Linux Kernel CVEs: What Has Caused So Many to Suddenly Show Up?","author":"Kroah-Hartman Greg","year":"2024","unstructured":"Greg Kroah-Hartman. 2024. Linux Kernel CVEs: What Has Caused So Many to Suddenly Show Up? The Linux Foundation. Retrieved October 20, 2025 from https:\/\/www.youtube.com\/watch?v=KumwRn1BA6s"},{"key":"e_1_3_3_2_24_2","volume-title":"Official CVE definition of vulnerability","author":"Kroah-Hartman Greg","year":"2024","unstructured":"Greg Kroah-Hartman. 2024. Official CVE definition of vulnerability. Retrieved October 20, 2025 from https:\/\/git.kernel.org\/pub\/scm\/linux\/security\/vulns.git\/tree\/cve\/vulnerability.txt"},{"key":"e_1_3_3_2_25_2","volume-title":"Repo for tracking and maintaining the CVE identifiers reserved and assigned to the Linux kernel project.","author":"Kroah-Hartman Greg","year":"2024","unstructured":"Greg Kroah-Hartman. 2024. Repo for tracking and maintaining the CVE identifiers reserved and assigned to the Linux kernel project.Retrieved October 20, 2025 from https:\/\/git.kernel.org\/pub\/scm\/linux\/security\/vulns.git"},{"key":"e_1_3_3_2_26_2","volume-title":"Linux Stable Commit Parse and Query Tool - Sourcehut Git","author":"Kroah-Hartman Greg","year":"2025","unstructured":"Greg Kroah-Hartman. 2025. Linux Stable Commit Parse and Query Tool - Sourcehut Git. Retrieved October 20, 2025 from https:\/\/git.sr.ht\/\u00a0gregkh\/verhaal"},{"key":"e_1_3_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSR66628.2025.00031"},{"key":"e_1_3_3_2_28_2","volume-title":"Google Finally Shifting To \"Upstream First\" Linux Kernel Approach For Android Features","author":"Larabel Michael","year":"2021","unstructured":"Michael Larabel. 2021. Google Finally Shifting To \"Upstream First\" Linux Kernel Approach For Android Features. Retrieved October 20, 2025 from https:\/\/www.phoronix.com\/news\/Android-Linux-Upstream-First"},{"key":"e_1_3_3_2_29_2","volume-title":"AUTOSEL: Modern AI-powered Linux Kernel Stable Backport Classifier","author":"Levin Sasha","year":"2025","unstructured":"Sasha Levin. 2025. AUTOSEL: Modern AI-powered Linux Kernel Stable Backport Classifier. Retrieved October 20, 2025 from https:\/\/lwn.net\/ml\/all\/aBj_SEgFTXfrPVuj@lappy\/"},{"key":"e_1_3_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1002\/9781118307656"},{"key":"e_1_3_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.48"},{"key":"e_1_3_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/3713081.3731727"},{"key":"e_1_3_3_2_33_2","volume-title":"CVEs and the NVD Process","author":"Standards National Institute\u00a0of","year":"2022","unstructured":"National Institute\u00a0of Standards and Technology. 2022. CVEs and the NVD Process. Retrieved October 20, 2025 from https:\/\/nvd.nist.gov\/general\/cve-process"},{"key":"e_1_3_3_2_34_2","doi-asserted-by":"crossref","unstructured":"Roger\u00a0B Newson. 2010. Comparing the predictive powers of survival models using Harrell\u2019s C or Somers\u2019 D. The Stata Journal 10 3 (2010) 339\u2013358. doi:10.1177\/1536867X10010003","DOI":"10.1177\/1536867X1001000303"},{"key":"e_1_3_3_2_35_2","volume-title":"Removing the stigma of a CVE","author":"Oliver Madison","year":"2022","unstructured":"Madison Oliver. 2022. Removing the stigma of a CVE. Retrieved October 20, 2025 from https:\/\/github.blog\/security\/vulnerability-research\/removing-the-stigma-of-a-cve\/"},{"key":"e_1_3_3_2_36_2","volume-title":"A script to calculate the number of Linux kernel CVEs published and rejected","author":"Park SeongJae","year":"2024","unstructured":"SeongJae Park. 2024. A script to calculate the number of Linux kernel CVEs published and rejected. Retrieved October 20, 2025 from https:\/\/github.com\/sjp38\/lazybox\/blob\/master\/cve_stat\/vulns_stat.sh"},{"key":"e_1_3_3_2_37_2","volume-title":"FedRAMP Vulnerability Scanning Requirements","author":"Program Federal Risk and Authorization\u00a0Management","year":"2018","unstructured":"Federal Risk and Authorization\u00a0Management Program. 2018. FedRAMP Vulnerability Scanning Requirements. Retrieved December 6, 2025 from https:\/\/www.fedramp.gov\/resources\/documents\/rev4\/REV_4_CSP_Vulnerability_Scanning_Requirements.pdf"},{"key":"e_1_3_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSR59073.2023.00056"},{"key":"e_1_3_3_2_39_2","unstructured":"Piotr Przymus Witold Weiner Krzysztof Rykaczewski and Gunnar Kudrjavets. 2026. Replication package for survival analysis of CVE lines in Linux kernel repository: \"Linux Kernel Recency Matters CVE Severity Doesn\u2019t and History Fades\". (1 2026). doi:10.6084\/m9.figshare.31144963.v1"},{"key":"e_1_3_3_2_40_2","series-title":"(ICSE-NIER \u201920)","first-page":"57","volume-title":"Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering: New Ideas and Emerging Results","author":"Raman Naveen","year":"2020","unstructured":"Naveen Raman, Minxuan Cao, Yulia Tsvetkov, Christian K\u00e4stner, and Bogdan Vasilescu. 2020. Stress and burnout in open source: toward finding, understanding, and mitigating unhealthy interactions. In Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering: New Ideas and Emerging Results (Seoul, South Korea) (ICSE-NIER \u201920). Association for Computing Machinery, New York, NY, USA, 57\u201360. doi:10.1145\/3377816.3381732"},{"key":"e_1_3_3_2_41_2","volume-title":"The EU Cyber Resilience Act: Strengthening Digital Security across Europe","author":"Research The Horizon\u00a0Europe","year":"2024","unstructured":"The Horizon\u00a0Europe Research and Innovation\u00a0Project DOSS. 2024. The EU Cyber Resilience Act: Strengthening Digital Security across Europe. Retrieved October 20, 2025 from https:\/\/dossproject.eu\/the-eu-cyber-resilience-act-strengthening-digital-security-across-europe\/"},{"key":"e_1_3_3_2_42_2","series-title":"(USENIX ATC\u201920)","volume-title":"Proceedings of the 2020 USENIX Conference on Usenix Annual Technical Conference","author":"Serrano Lucas","year":"2020","unstructured":"Lucas Serrano, Van-Anh Nguyen, Ferdian Thung, Lingxiao Jiang, David Lo, Julia Lawall, and Gilles Muller. 2020. SPINFER: Inferring Semantic Patches for the Linux Kernel. In Proceedings of the 2020 USENIX Conference on Usenix Annual Technical Conference(USENIX ATC\u201920). USENIX Association, USA, Article 16, 14\u00a0pages. https:\/\/dl.acm.org\/doi\/10.5555\/3489146.3489162"},{"key":"e_1_3_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464821"},{"key":"e_1_3_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-84800-044-5"},{"key":"e_1_3_3_2_45_2","doi-asserted-by":"crossref","unstructured":"Xin Tan and Minghui Zhou. 2019. How to Communicate When Submitting Patches: An Empirical Study of the Linux Kernel. Proc. ACM Hum.-Comput. Interact. 3 CSCW Article 108 (nov 2019) 26\u00a0pages. doi:10.1145\/3359210","DOI":"10.1145\/3359210"},{"key":"e_1_3_3_2_46_2","volume-title":"How the development process works","author":"community The kernel development","year":"2025","unstructured":"The kernel development community. 2025. How the development process works. Retrieved October 20, 2025 from https:\/\/www.kernel.org\/doc\/html\/v6.16\/process\/2.Process.html"},{"key":"e_1_3_3_2_47_2","volume-title":"Re: [Regression w\/ patch] Media commit causes user space to misbahave (was: Re: Linux 3.8-rc1)","author":"Torvalds Linus","year":"2012","unstructured":"Linus Torvalds. 2012. Re: [Regression w\/ patch] Media commit causes user space to misbahave (was: Re: Linux 3.8-rc1). Retrieved October 20, 2025 from https:\/\/lkml.org\/lkml\/2012\/12\/23\/75"},{"key":"e_1_3_3_2_48_2","volume-title":"A Look at 3 Months of Linux Kernel CVEs","year":"2024","unstructured":"TuxCare. 2024. A Look at 3 Months of Linux Kernel CVEs. Retrieved October 20, 2025 from https:\/\/tuxcare.com\/wp-content\/uploads\/2024\/07\/TuxCare-Report-3-Months-of-Kernel-CVEs.pdf"},{"key":"e_1_3_3_2_49_2","first-page":"2","volume-title":"Proceedings of the 14th International Conference on Mining Software Repositories, MSR 2017, Buenos Aires, Argentina, May 20-28, 2017","author":"V\u00e1squez Mario\u00a0Linares","year":"2017","unstructured":"Mario\u00a0Linares V\u00e1squez, Gabriele Bavota, and Camilo Escobar-Velasquez. 2017. An empirical study on Android-related vulnerabilities. In Proceedings of the 14th International Conference on Mining Software Repositories, MSR 2017, Buenos Aires, Argentina, May 20-28, 2017, Jes\u00fas\u00a0M. Gonz\u00e1lez-Barahona, Abram Hindle, and Lin Tan (Eds.). IEEE Computer Society, 2\u201313. doi:10.1109\/MSR.2017.60"},{"key":"e_1_3_3_2_50_2","volume-title":"Long-term support for Linux kernel to be cut as maintenance remains under strain","author":"Vaughan-Nichols Steven","year":"2023","unstructured":"Steven Vaughan-Nichols. 2023. Long-term support for Linux kernel to be cut as maintenance remains under strain. Retrieved October 20, 2025 from https:\/\/www.zdnet.com\/article\/long-term-support-for-linux-kernel-to-be-cut-as-maintenance-remains-under-strain\/"},{"key":"e_1_3_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1145\/1414004.1414052"},{"key":"e_1_3_3_2_52_2","volume-title":"Triaging Security Issues Reported by Third Parties","author":"Wellnhofer Nick","year":"2025","unstructured":"Nick Wellnhofer. 2025. Triaging Security Issues Reported by Third Parties. Retrieved October 20, 2025 from https:\/\/gitlab.gnome.org\/GNOME\/libxml2\/-\/issues\/913"},{"key":"e_1_3_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623188"}],"event":{"name":"MSR '26: 23rd International Conference on Mining Software Repositories","location":"Rio de Janeiro Brazil","acronym":"MSR '26","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 23rd International Conference on Mining Software Repositories"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3793302.3793364","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T10:46:43Z","timestamp":1785494803000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3793302.3793364"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,13]]},"references-count":52,"alternative-id":["10.1145\/3793302.3793364","10.1145\/3793302"],"URL":"https:\/\/doi.org\/10.1145\/3793302.3793364","relation":{},"subject":[],"published":{"date-parts":[[2026,4,13]]},"assertion":[{"value":"2026-07-31","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}