I don't think that Linus is dismissive of security, it is that he is very much a proponent of always rolling to the latest stable release.
Linux only ever wanted to promise support for the latest release and even Linux LTS is a concession.
And CVEs are basically a useless concept if you roll. (or at least not any more useful than any other bug tracker which supports tags)
> Linux only ever wanted to promise support for the latest release and even Linux LTS is a concession.
If he kept true of his "we don't break user space" instead of it being "we don't break user space until we do and then it's on you to deal with it" perhaps more people would be willing to run the latest release.