{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:HFLFGAU4LDR57UZRKRIUJXHFTN","short_pith_number":"pith:HFLFGAU4","canonical_record":{"source":{"id":"2601.22196","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-01-29T12:45:35Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"b649c9373c425f30575d54f4dc001e391517535304ec04126bb86e8d6dc2293c","abstract_canon_sha256":"b83a1d5af835d91c8552bf978d58feaa65020c5eeb17f9df3a2f2a348e773233"},"schema_version":"1.0"},"canonical_sha256":"395653029c58e3dfd331545144dce59b7700d6ed0d3d9cb97a469a4eedafc984","source":{"kind":"arxiv","id":"2601.22196","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2601.22196","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"arxiv_version","alias_value":"2601.22196v1","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2601.22196","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"pith_short_12","alias_value":"HFLFGAU4LDR5","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"pith_short_16","alias_value":"HFLFGAU4LDR57UZR","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"pith_short_8","alias_value":"HFLFGAU4","created_at":"2026-05-26T02:04:03Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:HFLFGAU4LDR57UZRKRIUJXHFTN","target":"record","payload":{"canonical_record":{"source":{"id":"2601.22196","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-01-29T12:45:35Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"b649c9373c425f30575d54f4dc001e391517535304ec04126bb86e8d6dc2293c","abstract_canon_sha256":"b83a1d5af835d91c8552bf978d58feaa65020c5eeb17f9df3a2f2a348e773233"},"schema_version":"1.0"},"canonical_sha256":"395653029c58e3dfd331545144dce59b7700d6ed0d3d9cb97a469a4eedafc984","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-26T02:04:03.960807Z","signature_b64":"eETdGLofkmXTSn8J55U0rFDKshOiq+mq329vW1HPItLEFV1wqk3P3Wb5+YR8Zam0zkmjCMdcg3C2x124kztUBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"395653029c58e3dfd331545144dce59b7700d6ed0d3d9cb97a469a4eedafc984","last_reissued_at":"2026-05-26T02:04:03.959861Z","signature_status":"signed_v1","first_computed_at":"2026-05-26T02:04:03.959861Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2601.22196","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-26T02:04:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"EX4b9w4BKlFEViY5iWieqNL08DlQpZ4PPZnwojEAaWxCye/+n2MNqTURJVoti4oNwOVg0y00abDcM8IQz+XUBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-26T20:02:15.817477Z"},"content_sha256":"378b71cf6c57b2dd1176153ba9cc0828d49529caf9fbd2f89c21fff970a2bf39","schema_version":"1.0","event_id":"sha256:378b71cf6c57b2dd1176153ba9cc0828d49529caf9fbd2f89c21fff970a2bf39"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:HFLFGAU4LDR57UZRKRIUJXHFTN","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Linux Kernel Recency Matters, CVE Severity Doesn't, and History Fades","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"(2) Amazon Web Services, Gunnar Kudrjavets (2) ((1) Nicolaus Copernicus University, Krzysztof Rykaczewski (1), Piotr Przymus (1), Poland, Seattle, Toru\\'n, USA), WA, Witold Weiner (1)","submitted_at":"2026-01-29T12:45:35Z","abstract_excerpt":"In 2024, the Linux kernel became its own Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA), formalizing how kernel vulnerabilities are identified and tracked. We analyze the anatomy and dynamics of kernel CVEs using metadata, associated commits, and patch latency to understand what drives patching. Results show that severity and Common Vulnerability Scoring System (CVSS) metrics have a negligible association with patch latency, whereas kernel recency is a reasonable predictor in survival models. Kernel developers fix newer kernels sooner, while older ones retain unresolved C"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2601.22196","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2601.22196/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-26T02:04:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"WQEo/5y8OwluY7ADckQuwIoA1P8dz+zW6QXs+3KWDFbEFi0xoyOHitO4a2ZrApKyPI4XeM/v8ey9Vf2gyPMZAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-26T20:02:15.817881Z"},"content_sha256":"0be7bdf299349691200638325bd82efefd921d588af7b8e05ad92749b167903a","schema_version":"1.0","event_id":"sha256:0be7bdf299349691200638325bd82efefd921d588af7b8e05ad92749b167903a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HFLFGAU4LDR57UZRKRIUJXHFTN/bundle.json","state_url":"https://pith.science/pith/HFLFGAU4LDR57UZRKRIUJXHFTN/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HFLFGAU4LDR57UZRKRIUJXHFTN/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-26T20:02:15Z","links":{"resolver":"https://pith.science/pith/HFLFGAU4LDR57UZRKRIUJXHFTN","bundle":"https://pith.science/pith/HFLFGAU4LDR57UZRKRIUJXHFTN/bundle.json","state":"https://pith.science/pith/HFLFGAU4LDR57UZRKRIUJXHFTN/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HFLFGAU4LDR57UZRKRIUJXHFTN/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:HFLFGAU4LDR57UZRKRIUJXHFTN","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b83a1d5af835d91c8552bf978d58feaa65020c5eeb17f9df3a2f2a348e773233","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-01-29T12:45:35Z","title_canon_sha256":"b649c9373c425f30575d54f4dc001e391517535304ec04126bb86e8d6dc2293c"},"schema_version":"1.0","source":{"id":"2601.22196","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2601.22196","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"arxiv_version","alias_value":"2601.22196v1","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2601.22196","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"pith_short_12","alias_value":"HFLFGAU4LDR5","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"pith_short_16","alias_value":"HFLFGAU4LDR57UZR","created_at":"2026-05-26T02:04:03Z"},{"alias_kind":"pith_short_8","alias_value":"HFLFGAU4","created_at":"2026-05-26T02:04:03Z"}],"graph_snapshots":[{"event_id":"sha256:0be7bdf299349691200638325bd82efefd921d588af7b8e05ad92749b167903a","target":"graph","created_at":"2026-05-26T02:04:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2601.22196/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In 2024, the Linux kernel became its own Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA), formalizing how kernel vulnerabilities are identified and tracked. We analyze the anatomy and dynamics of kernel CVEs using metadata, associated commits, and patch latency to understand what drives patching. Results show that severity and Common Vulnerability Scoring System (CVSS) metrics have a negligible association with patch latency, whereas kernel recency is a reasonable predictor in survival models. Kernel developers fix newer kernels sooner, while older ones retain unresolved C","authors_text":"(2) Amazon Web Services, Gunnar Kudrjavets (2) ((1) Nicolaus Copernicus University, Krzysztof Rykaczewski (1), Piotr Przymus (1), Poland, Seattle, Toru\\'n, USA), WA, Witold Weiner (1)","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-01-29T12:45:35Z","title":"Linux Kernel Recency Matters, CVE Severity Doesn't, and History Fades"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2601.22196","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:378b71cf6c57b2dd1176153ba9cc0828d49529caf9fbd2f89c21fff970a2bf39","target":"record","created_at":"2026-05-26T02:04:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b83a1d5af835d91c8552bf978d58feaa65020c5eeb17f9df3a2f2a348e773233","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-01-29T12:45:35Z","title_canon_sha256":"b649c9373c425f30575d54f4dc001e391517535304ec04126bb86e8d6dc2293c"},"schema_version":"1.0","source":{"id":"2601.22196","kind":"arxiv","version":1}},"canonical_sha256":"395653029c58e3dfd331545144dce59b7700d6ed0d3d9cb97a469a4eedafc984","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"395653029c58e3dfd331545144dce59b7700d6ed0d3d9cb97a469a4eedafc984","first_computed_at":"2026-05-26T02:04:03.959861Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-26T02:04:03.959861Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"eETdGLofkmXTSn8J55U0rFDKshOiq+mq329vW1HPItLEFV1wqk3P3Wb5+YR8Zam0zkmjCMdcg3C2x124kztUBw==","signature_status":"signed_v1","signed_at":"2026-05-26T02:04:03.960807Z","signed_message":"canonical_sha256_bytes"},"source_id":"2601.22196","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:378b71cf6c57b2dd1176153ba9cc0828d49529caf9fbd2f89c21fff970a2bf39","sha256:0be7bdf299349691200638325bd82efefd921d588af7b8e05ad92749b167903a"],"state_sha256":"6c7a66c1f2cf681c66cf79f29462701235001bb67b7d360028112052b4f8118a"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0y1Sn0N5c9b77bLkVgEVfkkFDV4DepX6qoUJR6lPUWp5bOCoSkBYlPuw8moCk9WM9EicFvph+8uAnR/jaUDJBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-26T20:02:15.821290Z","bundle_sha256":"d3292c23afd41f78ae7a3738f45b9eb3a1b6d48495b0c25ce1f7652054de2e50"}}