Comment by pavon

It is in a module, so it doesn't create risk for anyone that isn't loading that module. And most distros don't use it by default, you have to go out of you way to configure it.

I do wish distros would start moving more kernel modules into separate packages so it is obvious to security scanners and individual users whether a CVE impacts them or not. I'm sure I've rebooted my computer many times due to kernel packages updates when it probably wasn't needed. And put off security updates for a few days until I was able to reboot, when I could have installed them right away.