“ This issue was initially discovered in 2016 by a RedHat kernel developer and disclosed in a public email thread, but the Linux kernel community did not patch the issue until it was re-reported in 2021.”
Insane.
Insane.
People there were thinking about this as a possible fix for a hypothetical crash, not a security issue, and no one was able to prove that there was a crash, nor that the patch fixed it.
No one bothered reviewing it, and the original person who raised the patch didn't advocate further.
None of this seems even close to "insane", this seems like exactly what you expect in most software projects. "Hey, can you explain the bug this patch fixes more?" -> contributor vanishes into the aether -> nothing happens.