The Linux kernel's practice of assigning CVE identifiers to nearly every bugfix has sparked debate over whether the sheer volume of reported vulnerabilities is inflating security metrics and causing CVE fatigue. Critics argue this overly cautious approach conditions users to ignore critical updates, suggesting that better triaging is needed to distinguish actual security risks from standard bug fixes.