Researchers at Nebula Security discovered a privilege escalation bug in the Linux kernel that's been lying dormant for over 15 years that affects every Linux distribution before version 7.1.
This is exactly why you should stay away from stable/LTS desktop distros. If you’re on Fedora, Arch etc you’re already on kernel 7.1
Apparently the fix was backported for LTS distros as well.
Thank you for mentioning this, since I somehow missed this happening
It doesn’t make sense. Everyone should avoid outdated OS like Debian. But for Linux, only LTS is ready for production.
From GrapheneOS:
The Linux kernel is a fundamentally anti-security project. It started as a rejection of a more robust and secure OS design. It continues being nearly entirely written in a memory unsafe language where tiny mistakes lead to endless severe vulnerabilities.
Linux kernel has an immense number of severe regressions with new releases. That’s why long term support branches are used on production servers and end user devices including RHEL, Android, ChromeOS and far beyond those. A hobbyist OS for power users is a different space.
Upstream Android currently uses the 6.1, 6.6 and 6.12 LTS branches which are still maintained upstream and receive frequent updates. Even those LTS revision updates have frequent major regressions which we have to deal with since we closely follow the LTS releases for GrapheneOS.
The Linux kernel’s very transparent development enables seeing how clearly the architecture, language choice and overall development priorities mix with security in 2026. It’s an enormous monolithic kernel written in C with massive complexity to micro-optimize performance.
Android uses GKIs, to my knowledge no major desktop distro supports it so its best to just stick to latest kernel. What benefits would deploying a standard LTS kernel on a distro like Fedora have?
(For those unaware, “GKIs” in this context probably refers to “Generic Kernel Image(s)”)
Yeah the idea of not using LTS so you always have latest security updates is total nonsense.
In production environments, every company uses an LTS kernel. I never saw a company use non lts kernel except for dev buildfarms.
While it’s true that LTS kernels are prone to avoiding backport fixes due to the mess in Linux CNA due to how GKH handles stuff, production environments still prefer LTA because it’s genuinely safer to use if you have a contract with a security company that makes kernel patches.
All I’m saying is, people have done PhD on this topic and you can’t just make those blanket statements. And you shouldn’t conflate LTS kernel with desktop stable release distros.
I am not conflating stable distros with LTS kernels although I did jump to a conclusion too quickly.
That’s not what I was saying. I was refferring to the very flawed backporting LTS distros like Debian use. From PG’s Linux overview:
We highly recommend that you choose distributions which stay close to the stable upstream software releases, often referred to as rolling release distributions. This is because frozen release cycle distributions often don’t update package versions and fall behind on security updates.
For frozen distributions such as Debian, package maintainers are expected to backport patches to fix vulnerabilities rather than bump the software to the “next version” released by the upstream developer. Some security fixes (particularly for less popular software) do not receive a CVE ID at all and therefore do not make it into the distribution with this patching model. As a result, minor security fixes are sometimes held back until the next major release.
That doesn’t really go into enough detail imo. It’s very broad strokes to keep the masses safe. Too many people use Debian testing or use backports (which don’t always get security updates) because they want the latest versions which defeats the point of using Debian. Debian themselves say that stable always gets security updates, even when it gets frozen (it isn’t constantly frozen like that article makes it sound).
Debian Stable always gets security updates when there’s a CVE. Vulns don’t always have a CVE assigned, unfortunately.
I stand corrected then. Apologies to anon5064204
How come using Arch means that those same vulnerabilities would be fixed though?
If it doesn’t have a CVE because the vendor hasn’t acknowledged it then the same vendor wont have fixed it upstream for any distro. Right?
If the vulnerability is patched without a CVE the fix will be in the next kernel release. Arch is always on the newest kernel version.
No, that’s the worst part. GKH sometimes silently pushes fixes, and sometimes don’t. Linux kernel doesn’t really follow any policies.
“Open source is safe because everyone is constantly checking it”
Vulnerability sits around for 15 years..
No idea who to trust any more, but at least there’s visibility i suppose.
Unbelievable. Fifteen years is a long time. I imagine that certain countries have been exploiting this vulnerability for many years.
I have doubt too about opensource security future, especialy since AI has started to be weaponized.