grsecurity - The Reports of CVE's Death Have Been Greatly Exaggerated
grsecurity.net
A prominent Linux kernel developer wants to replace CVE's use on the kernel by rebranding another kind of identifier that has been around for years. We look into why that's unlikely to happen any time soon.

This basically means that fixes for most security vulnerabilities are not be able to be back-ported to LTS kernels but on the other side around stable releases contain all security fixes made so far.

In other words, use stable Kernels over LTS, whenever possible, assuming everything works for you and there are no specific circumstances such as working in an environment where you have no control over the Kernel - limited access etc.

  • @kevincox@lemmy.ml
    1•2 years ago

    Missing hardening features is very different than missing fixes. I would expect that LTS kernels don’t get new major features such as hardening changes even if they “improve security”.

    • CHEF-KOCHOP
      -5•2 years ago

      The point is that what you call hardening features can help to address known vulnerabilities. This will increase security one way or another.

      Now bring evidence that I am wrong, whops there is none.

      • @kevincox@lemmy.ml
        4•2 years ago

        Sure. I agree with “Prefer stable kernels because they have the latest security harderning”. I was just disagreeing with “most security vulnerabilities are not be able to be back-ported to LTS kernels”.

        Now bring evidence that I am wrong

        Haha. Good joke. Not worth responding to.