In the 2019 article that is linked to in the LWN article posted upthread, that's exactly what Greg Kroah-Hartman suggested: use the change ID that the Linux kernel is already using as a vulnerability identifier.
Unfortunately, it does not appear that that proposal gained traction, since it's not discussed at all in the more recent LWN article.
Comments
In the 2019 article that is linked to in the LWN article posted upthread, that's exactly what Greg Kroah-Hartman suggested: use the change ID that the Linux kernel is already using as a vulnerability identifier.
Unfortunately, it does not appear that that proposal gained traction, since it's not discussed at all in the more recent LWN article.