Seems a little crazy. Somebody should evaluate blast radius and do appropriate distro notifications in a case like this (I presume the impact was part of the disclosure, so not much extra work).

You know the linux kernel is a free software project right? If you think “somebody should” do a thing but you aren’t prepared to do it yourself then you should maybe ask for a full refund.

Thank you very much, seanhunter. You hit the nail on the head there.

Not really, because they made Linux a CNA specifically to own the process and distort it the way they want it to be.