My distribution just installed its latest available kernel, but the upstream kernel project lists that kernel as end of life. I'm security-conscious, so does that mean I'm running an unsupported kernel?
Should I worry if my distro's kernel is marked end of life?
Asked by
Dorklet
Answers
Check the support status of your distribution and its kernel package, not just the upstream kernel branch. Distributions can maintain their own kernels and apply security fixes even when upstream no longer maintains that version.
If your distribution release is supported and you're receiving its current kernel updates, the upstream label alone doesn't mean you're unprotected. Look at the distribution's security advisories and kernel package updates if you want to verify what it's maintaining.
Reply to this answer
Think about whether you're on a maintained update stream. A kernel version being replaced upstream is different from an entire distribution release no longer receiving security updates. Keep the system updated and make sure you boot into the newer kernel after it's installed.
That doesn't guarantee every vulnerability is fixed immediately. If a particular issue worries you, check whether your distro has released a fix for it.
Reply to this answer
There's still a possible gap when upstream support ends before a distro moves to another branch. How much that matters depends on what fixes the distro provides in the meantime and which vulnerabilities affect your system. I wouldn't panic over the label, but I also wouldn't assume there's zero risk.
Reply to this answer
You don't need to compile a mainline kernel just because its version is newer. The distro kernel is packaged and maintained for your system. Switching to a self-built kernel also makes you responsible for keeping it updated.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Dorklet:
So the version number alone doesn't tell me whether my distro is still fixing security issues?
Quibzy:
Right. A fix can be applied to a distro package without changing it to the latest upstream version, so the package changelog or advisory is more useful.