A distribution rates a CVE by its effect on its own packages and default setups, while CVSS rates the flaw in general. Ubuntu states its priority levels are distinct from CVSS base scores. So the two can disagree, and a sensible triage reads both alongside exploitation evidence.
Two different questions
CVSS describes the intrinsic severity of a flaw. FIRST's specification says the Base score reflects intrinsic characteristics that are constant over time and assumes a reasonable worst case across deployed environments.
A distribution asks something narrower: how bad is this for our users, in how we package and configure this software? Ubuntu says its priority depends on factors such as severity, importance, risk, estimated number of affected users, software configuration, and active exploitation. It also says these priority levels are distinct from other published severity levels such as CVSS base scores, whether its own or those used in the National Vulnerability Database.
How Ubuntu describes its levels
Ubuntu uses Critical, High, Medium, Low and Negligible. Its description of Low is useful: a security problem that is hard to exploit due to the environment, requires a user assisted attack, has a small install base, or does very little damage. Negligible is technically a security problem but theoretical or with almost no install base.
So a CVE with a high CVSS score can land at Low in a distribution when the vulnerable code path is not enabled by default, or few users run it.
Why the version number can mislead
Debian's security FAQ explains that it backports security fixes to the version shipped in a release rather than moving to a new upstream version. The package version string therefore can still look vulnerable after the fix is in. A scanner that matches only on version numbers will report a problem that the distribution has already addressed.
What to do with the difference
| You see | Likely meaning | Action |
|---|---|---|
| High CVSS, distro says Low or Negligible | Limited exposure in default builds | Check your configuration, then schedule normally |
| High CVSS, distro says Not affected | Package does not include the flaw | Record the reason, close |
| Version looks vulnerable, distro shows Fixed | Backported patch | Confirm the package build, close |
| Low CVSS, distro says High | Distribution sees real exposure | Take the distribution's view seriously |
| No distro entry yet | Not assessed | Treat on CVSS and exploitation signals |
Always read the notes on the distribution's page. They often explain the reasoning.
Add the signals neither one covers
Neither CVSS nor a distro priority tells you whether your application reaches the vulnerable code or whether your service is exposed. Add exploitation evidence, exposure, and reachability to settle the final order.
Quick check
Should I trust the distro rating over CVSS?
For packages from that distribution, the distro rating reflects how the software is built and shipped, so it is usually more specific. Still confirm against your own configuration.
Why does my scanner flag a package the distro says is fixed?
Likely the scanner matched the upstream version string and missed the backported fix. Check the distribution's advisory entry.
Sources
- Ubuntu, About CVEs: priority levels and statuses
- Debian Security FAQ
- FIRST, CVSS v4.0 specification document
Last reviewed: 19 October 2026.
