What the kernel published, and whether the fix reached you

The kernel project assigns no CVSS scores, by policy. Severity in the kernel is a function of what you build and where the device sits, and a single number cannot carry that. Where a score appears in a kernel record it is the CNA’s own secondary metric, not NVD’s. NVD analysis for a large batch can trail publication by weeks. Prioritise by reachability, not by a number.

Weekly volume is not a quality signal. The four windows below run 46, 1,086, 6, 227. The 1,086 was a backlog of older assignments published in one batch; the 227 was one full stable cycle landing at once. A week with a big number is usually a week the CNA caught up, not a week the kernel got worse.

A commit date proves a branch is alive, not that a fix is in it. The second table measures the gap between the newest upstream release in a series and the last commit on the vendor branch that pins it. A branch that moved yesterday may still not carry this cycle’s backports — the date narrows where to look, it does not close the question. Read the branch log before you ship.

The per-CVE detail lives in the weekly advisory, linked from each row. This page carries what stays true between them.

Every maintained longterm series took a patch release on 2 September 2026. Each row below is one of the 17 SoCs on the BSP status table, showing the gap between that release and the last commit on the vendor branch it pins. 9 of 17 have not moved since that cycle.