Every bugfix is assigned a CVE.

"the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team."

https://docs.kernel.org/process/cve.html