@palin @mjg59 I guess it depends on how you define "OS". It's software that is preinstalled on the device, is central to the functionality of the device, and is upgraded as part of the firmware.

So while it isn't a kernel vulnerability, I'd probably still class it as an operating system vulnerability for the device.