Linux CVE assignment process

As described previously,
the Linux kernel security team does not identify or mark or announce any sort
of security fixes that are made to the Linux kernel tree. So how, if the Linux
kernel were to become a CVE Numbering Authority (CNA) and responsible for
issuing CVEs, would the identification of security fixes happen in a way that
can be done by a volunteer staff? This post goes into the process of how
kernel fixes are currently automatically assigned to CVEs, and also the other
“out of band” ways a CVE can be issued for the Linux kernel project.