I have to track vulnerabilities for a legacyish (3.12) Linux Kernel. For this purpose I'm searching on various sites like NVD for new vulnerabilities. Recently I encountered a problem where the affected version of the vulnerability was described as
cpe:/o:linux:linux_kernel:4.4:rc8 and previous versions. But when I compared the sources of the Linux Kernel version 3.12 with the fix for this vulnerability I can see that the modification which caused the vulnerability was applied in a later version. This leads me to the question:
Is there a way to determine the version of the Linux Kernel where a vulnerability was introduced without analyzing the source code manually?