Does the version next to pending refer to kernel version for which the fix is released?
Yes- more precisely, the version next to "pending" refers to the version of the package within the lineage in which the fix is included.
There are lots of binary packagings of the upstream kernel sources for different hardware platforms and other use cases- "linux", "linux-mako", "linux-snapdragon", etc- and there are also many release lineages- Ubuntu 12.04 LTS/14.04/etc- of all those packages that are maintained concurrently.
So the upstream bug may need to be fixed in multiple packagings of the same sources across multiple lineages. Because of the complexity, a triage process is used to conduct the relevant classifications and track work. This page reports on the state of that triage process for this particular bug.
This can be traced as follows:
pick one of the packages- "linux"- and one of the lineages- "Ubuntu 12.04 LTS".
The table indicates that the state of the fix for that package in that lineage is "pending". The version of the package that will contain the fix within that lineage is "3.2.0-109.150".
to confirm, follow the lineage link for the package- https://launchpad.net/ubuntu/precise/+source/linux
scroll down to the "Releases in Ubuntu" section of the lineage-package page, and find the specific fix version, which has its own page: https://launchpad.net/ubuntu/+source/linux/3.2.0-109.150
on that page is a changelog. In that changelog includes a reference to the CVE (CVE-2016-5696), the particular fix that was made, and the person who made it
The CVE page is confusing because it is automatically published from a complex data model that tracks the interrelationships between upstream sources and their packagings within and across lineages. It follows a template that is optimized for authority, not necessarily for readability.
The classifications, like "DNE" or "pending" refer to the triage and release workflow that Ubuntu follows. States on that page are:
- "DNE" means that the package does not exist within the lineage
- "ignored" means that energy is not being expended for determining whether the problem exists in the particular package within the lineage, because support has ended for one reason or another. See for instance the linux-lts-quantal package, in the Ubuntu 12.04 LTS lineage. Support for that particular package (a backported hardware enablement package) in that lineage is beyond end-of-life.
- "needs triage" means that the package within the lineage is still supported, but work is needed to determine if the reported problem actually exists within that package-lineage pair. See for instance the "linux-goldfish" package in Ubuntu 16.10.
- "not affected" means that the underlying source code vulnerability exists in the particular package within the lineage, but triage determined that for some other reason the issue will not occur. See for instance "linux-mako" within Ubuntu 16.04 LTS.
- "needed" of course means that triage has determined that the package within the lineage is affected, but work to apply the fix to the particular package within the lineage is still needed. See for instance the linux-armadaxp package within the 12.04 lineage.
- "pending" means that the work needed to apply the fix to the particular package within the lineage has been done, a version has been cut, and a release is in the works.
- "released" means that the fix for the package within the lineage has been released