Reassessing Linux Kernel Vulnerability Severity: An Independent Audit of 2026 CVSS Scores

abstract

Vulnerability severity scores guide patching, compliance, and security investment. Their usefulness depends on whether the assumptions behind them withstand independent scrutiny. We develop a reproducible agentic workflow that examines Linux kernel patches, source code, and public technical documentation before independently assigning CVSS metrics, without access to published scores. Applied to 500 sampled CVEs, the workflow produces assessments that are lower than the Linux CNA's in 98% of comparable cases, with an average difference of 3.74 points. Most of the gap comes from confidentiality and integrity assumptions. Technical review finds both overstated published consequences and overly conservative automated judgments; clearer scoring guidance narrows the gap without removing it. These findings call for transparent, evidence-linked severity assessments and independent evaluation of the assumptions connecting software defects to security consequences.

pdf preview

citation

Bommarito, M. J., II (2026). Reassessing Linux Kernel Vulnerability Severity: An Independent Audit of 2026 CVSS Scores. Working paper (draft). Working draft, October 2026. 17 pages, 3 figures, and 3 tables. Comments welcome..