The distros don't need upstream to handle CVEs, they can probably handle many of the CVEs themselves or via sharing patches on the oss-security/other mailing lists.