CVE-2021-4440 and the Limits of the CNA System

grsecurity publishes a detailed case study dissecting how CVE-2021-4440, a flawed 5.10 LTS backport that skipped the MDS buffer clearing on the syscall return path, was assigned and publicized through the CVE system. The article critiques the Linux kernel CNA (CVE Numbering Authority), pointing out that the record carries the wrong year, a wrong commit reference, and a description copied from the fix that implies Xen is needed to exploit the bug. It also argues that the CNA’s automation identifies fixes rather than vulnerabilities, leaving impact assessment to distributions and users. None of this should come as a surprise: when the kernel became its own CNA in February 2024, its team announced it would be “overly cautious” and assign CVE numbers to any bugfix it identifies. As more orgs rely on CVEs for patching, compliance, and reputation, the integrity of the system matters.