I would change that "Yep" to "Kinda, sorta"..
Someone attempted to get a backdoor into the Linux kernel by putting some code in the public CVS tree. Thing is, it was spotted almost right away and even if it weren't, it wouldn't've gotten into a full release of the kernel. The code was only put into the CVS tree, not the BitKeeper tree that all the releases are built from (including the CVS tree). I'm suprised there's even commit access to the CVS tree since it's supposed to be pull only.