Comment by serbuvlad

I don't think that Linus is dismissive of security, it is that he is very much a proponent of always rolling to the latest stable release.

Linux only ever wanted to promise support for the latest release and even Linux LTS is a concession.

And CVEs are basically a useless concept if you roll. (or at least not any more useful than any other bug tracker which supports tags)