The SPDK community has a documented CVE process here that describes both how to report a potential security issue as well as who to contact for more information.