It’s not. If you look at the analysis, the bug is present only in one version of the kernel everything else the same. It’s the kernel.

Also here’s a kernel developer confirming they think it’s the kernel: https://news.ycombinator.com/item?id=49134550