Open Source Summit India 2026

The Linux kernel is now a CVE Numbering Authority, a change that has driven an unprecedented increase in reported kernel vulnerabilities. In Kubernetes environments, this shift has amplified compliance requirements that mandate per-CVE tracking, remediation, or justification.

This talk presents a methodology for kernel CVE pruning via static code reachability analysis. We map CVEs to vulnerable kernel functions and evaluate whether those functions are reachable under a specific kernel configuration and execution environment. The analysis incorporates build-time configuration (Kconfig), loadable modules, and inter-procedural call graphs to approximate practical exploitability.

We present an open-source tool that automates this analysis and evaluate it with representative workloads. Our results show that many kernel CVEs are in unreachable code, yielding a high reduction in reported exposure. We also discuss limitations and implications for compliance-driven vulnerability management.