[glibc] advisories: Document rejection process in README.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=979e4dc4a0ce4f242f5d075d58048ba6f7f1c9e2

commit 979e4dc4a0ce4f242f5d075d58048ba6f7f1c9e2
Author: Carlos O'Donell <[email protected]>
Date:   Tue Apr 21 12:16:29 2026 -0400

    advisories: Document rejection process in README.
    
    Reviewed-by: Siddhesh Poyarekar <[email protected]>

Diff:
---
 advisories/README | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/advisories/README b/advisories/README
index b8f8a829ca..330a31dff3 100644
--- a/advisories/README
+++ b/advisories/README
@@ -25,6 +25,10 @@ This is the CVE-Id assigned under the CVE Program
 Public-Date:
 The date this issue became publicly known.
 
+Rejected-Date:
+The most recent date the assigned advisory was rejected. If the advisory
+is ever published again the Rejected-Date tag should be removed.
+
 Vulnerable-Commit:
 The commit that introduced this vulnerability.  There could be multiple
 entries, one for each release branch in the glibc repository; the
@@ -67,6 +71,17 @@ An advisory for a CVE needs to be added on the master branch in two steps:
 
 4. Verify the updated advisory and push the result.
 
+Rejecting an Advisory
+---------------------
+
+Rejecting an advisory on the master branch can be done in one step:
+
+1. Mark the advisory as rejected. Add the text "REJECTED: " as a prefix
+   to any short-form description. Add a new paragraph that starts with
+   "REJECTED: " and explains the reason for the rejection including
+   justification for why it no longer has security impact.  Lastly add
+   a Rejected-Date tag to the advisory.
+
 Getting a NEWS snippet from advisories
 --------------------------------------