I regularly read about some vulnerability being fixed in the Linux kernel, but only in the latest kernels, and that it still has to be backported to LTS kernels. Today I saw a message by kernel developer Greg Kroah-Hartman that the number of unfixed CVEs in LTS 5.4 is currently 1100 https://www.openwall.com/lists/oss-security/2025/04/10/5
That's why downstream non-rolling release distros have their own security vuln. trackers and teams patching it.