It is often difficult to assess the consequences of a bug, especially in large and complicated project like an OS kernel. It could take lot of time, and it is easier just to fix the bug and err on the safe side by calling it a potential "vulnerability". Especially when nobody pays a bounty for proof-of-concept.