> What do you mean?

No analysis is being done in the linux kernel to assess vulnerability.

> It isn't a DoS to assign every single bug fix a CVE!

On people who care about this, it is, not in the project itself though.

> Every single bug is making someone vulnerable in some way.

Not every bug is making someone vulnerable. (docs bugs, test bugs) behavioral changes, performance improvements, the list goes on.