it sounded to me like they just discover the bug a few days ago and were corresponding privately with some kernel developers