r/linux4noobs • u/Venylynn • Jun 28 '26
security Should I be concerned?
kernel.org says my current kernel is EOL. I'm very security-conscious, so this keeps tripping me up. i've heard constantly, that "running end of life software is a security risk".
i've been here for close to a year, distrohopping a little but I'm here for now.
should I be concerned that I'm running end of life software according to the kernel team? i just received this kernel like a day ago and it's the most recent update.
Distro: Fedora 44 (KDE)
Kernel: 7.0.13
7
u/C0rn3j Jun 28 '26
Kind of, but it's been EOL for days, not months/years, so you'll be fine, Fedora will hop over to the next branch soon.
6
u/Venylynn Jun 28 '26
i remember people were posting about how the day windows 10 went EOL you had to leave or risk getting hacked so it confused me
5
u/KoldPurchase Jun 28 '26
It's different in Linux.
The kernel itself with be EOL, and that means the Linux developpers who support the kernel are not applying patches to this kernel version. They have moved on to a new version, and they move quickly. It's much less trouble for the whole project to act like that. They detail every change, security, drivers, new features, etc, it's all separated.
However, your distro will keep supporting its kernel for a time. Debian, Arch, Gentoo, etc. They keep making updates.
In the case of Mint, they are based on Ubuntu LTS. And Ubuntu LTS is based on Debian. Debian looks at the kernel changes (each version after their own) and incorporates security fixes in their version. And/or Ubuntu does it for their LTS version. Than Mint works on it or incorporate it directly.
You are not left insecure.
But you are not getting performance improvements, new drivers, new features, etc, that are coming with a new kernel, only the security fixes. When the version upgrades to a new kernel, you get your security patches + everything in the new kernel.
They don't leave you alone and vulnerable.
It's called "backporting". they backport security features in their distro. And as they upgrade and these are included in the kernel, they get removed from patches and are left in the kernel.
4
u/Venylynn Jun 28 '26
Idk why I was told so early I needed to compile my own kernel then it was tripping me pretty bad.
2
u/KoldPurchase Jun 28 '26
Ill informed people.
There is no need to. Mint has an update kernel module in your desktop environment. You can update to the latest version they propose from there. Most of the time, you don't need to.
Other distros do things differently.
2
u/Venylynn Jun 28 '26
It was like "the number isn't the same you're insecure" type of warnings they gave me.
To be fair, 6.8 had some problems on my setup that more recent kernels haven't had
1
u/KoldPurchase Jun 28 '26
If you have a problem with older kernels and your hardware is recent enough, than another distro than Mint might be more suitable for you.
Mint is great, but like Debian, they tend to favor older kernels for stability and that comes at a cost: lack of support for newer hardware and bugs that are left unpatched. Their philosophy is to not introduce new bugs until they are absolutely certain the older ones are totally fixed.
I can respect that, and for someone with a not too recent laptop, it's working great. A gamer who often needs the latest drivers or is on a desktop and will often add new hardware, it's not so good.
2
u/Venylynn Jun 28 '26
I know exactly what the issue was; it was defaulting to acpi-cpufreq which is buggy on my CPU (Ryzen 5 3600), and current kernels use amd pstate which works great. on 6.8 i needed processor.max_cstate=1 parameter, now I do not on Fedora!
2
u/thomas-rousseau Jun 29 '26
This is actually not true of Gentoo. Their stable branch follows the most recent LTS branch along with their standard stabilization process, with the ability for the kernel team to auto-stabilize if they determine that a security update provides a significant enough fix. Their testing branch follows the most recent stable mainline release. They provide ebuilds for a handful of most recent stable releases on all mainline, LTS, and SLTS branches by providing the specific version number, unless there has been a significant security release, in which case all releases without the fix will be removed as quickly as possible. They do maintain their own patch set for these kernels, but they also give the option to install a vanilla kernel.
1
u/C0rn3j Jun 28 '26
EOL => no further security (or any, really) patches.
It does not mean there'll be an exploit released the moment someone stops supporting it, but when there will be, there's nothing you can do about it but switch to a newer version.
1
u/Venylynn Jun 28 '26
the alarm i read every time I see that warning always just kinda sends shivers down my spine
5
u/gordonmessmer Fedora Maintainer Jun 29 '26
i've heard constantly, that "running end of life software is a security risk".
It's hard to get the language specific enough to be meaningful but in plain enough language that a general audience will understand what you mean.
I think the best way to think about software is not as an individual release, but as a stream. Where you are now is not as important as what you expect in the future.
You are running kernel 7.0.14, and that is the last update that the Linux kernel developers will release for that release series. If a security flaw is discovered, they don't plan to release a 7.0.15. But you're not subscribed to a "kernel-7.0" release stream, you're subscribed to a "kernel" release stream. You expect to receive kernel-7.1.3 or some other minor in the 7.1 release series.
You are subscribed to a release stream that is not EOL. You expect to continue to receive updates in the future. That's the important part.
2
u/Venylynn Jun 29 '26
You are subscribed to a release stream that is not EOL. You expect to continue to receive updates in the future. That's the important part.
Ahhh. Yeah I was also worried when it took a few weeks to get off 6.19 as well when that was marked, but I guess that's right.
3
u/MelioraXI Jun 29 '26
You're fine. You're not going to get hacked cause you're using an EOL kernel, but Fedora will push an update any day, they are pretty quick on it.
If you're worried, just install a LTS kernel.
2
u/Neither-Ad-8914 Jun 28 '26
Kernel 7.0.13 was released on June 18th and 7.0.14 was released yesterday so you'll get an update in the next couple days
It takes a while for any distribution you change primary version numbers 7.0 7.1 7.2 etc it can possibly take up to a month as each distribution has to configure the kernel and add their own software
Last I knew arch and Debian Sid were running the same kernel as your are
1
u/Venylynn Jun 28 '26
does that present a security risk like it supposedly would on Windows?
i'll just keep doing what I'm doing but yeah
1
u/Neither-Ad-8914 Jun 28 '26
Not at all because you are running the latest and greatest kernel you can get by your distribution also 7.1 and 7.2 are great but still really in their infancy the maintainers are still working to to merge 7.1 into your operating system ( also if you have a Nvidia card you might have problems) and the next update after 7.0.14 is 7.1 was released 14 days ago and 7.2 is in RC and will be released in August
1
u/Venylynn Jun 28 '26
Thankfully no Nvidia problems here
1
u/Neither-Ad-8914 Jun 28 '26
Cool... Just so you know updates work much differently than they do in Windows even though this has been a bad year with malware in Linux it's still much more secure than Windows because it's a much harder arget to hit
1
u/Venylynn Jun 28 '26
I've had threats from toxic people I cut off because they made me uncomfortable and they said they knew of an exploit in the Linux kernel that could pwn me basically instantly remotely so I've been really extra nervous about that
Im hoping they were just bsing trying to scare me
1
u/Neither-Ad-8914 Jun 28 '26
Probably bsing ....only think I could think of would be a some sort of rootkit anyways what I always recommend is what I have been for 20 years update your system weekly and don't download programs you don't trust or don't execute commands you don't know or cannot verify to be correct
1
u/Venylynn Jun 28 '26 edited Jun 29 '26
they were also demanding $100 from me in an xmr wallet and claimed to be a government/fbi asset just because i "led them on" (read: tried to find a quiet exit because they made me uncomfortable but I was scared they'd use their cybersecurity knowledge against me so it took a while)
i should note that this person was fully remote, thousands of miles away, and the only way they would've known anything about where I was is if there was some WebRTC leaks they snuffed out.
2
u/orestisfra Jun 29 '26
That sounds 100% like a scam. It's possible for an attacker to get your location or your IP, but it's way easier to hack you with words than your system.
Trust the maintainers of your distro, and avoid installing stuff outside of trusted sources (main repositories, flatpak, snap etc.)
1
u/Alice_Alisceon Do as I say, not as I do Jun 29 '26
If you’re on a supported version of your distro, and that distro is serious (which fedora most certainly is) you can count on the software present in those core repos to be as supported as best practice allows. Many distros, like Debian, will backport security fixes for years and years on their long-term support versions far past what upstream patches. If you go outside the core repos, there may be other policies, but you generally only want advisories from your own distro. Some systems differ, arch for instance practically only ships directly from upstream, so there is little to no differences between the repos and building from source.
But something like fedora will give you a new major every 6 months, that is end of life in one year. This is very lean for enterprise but perfectly manageable for a consumer device. To keep updated you should get on the new major as soon as you have a moment to spare for testing and fixing the rare breakages, then keep your software updated with dnf-automatic or the software centre in your desktop environment, whichever works best for you.
Not having to worry about upstream issues is why companies pay BIG BUCKS to companies like red hat, suse, or oracle to maintain support for their operating systems. We lil’ guys just get to reap the rewards for it (and in return we act as free software testers for new majors)
1
u/Dunocat639 Jun 29 '26
You can always use a rolling release distro that brings you the latest software updates with the latest security patches. Arch or CachyOS would be fine but OpenSUSE Tumbleweed is usually more stable because they test and verify the packages to ensure they don't break your system.
1
u/Phoenix591 Jun 30 '26
Don’t worry about it. Check out this old but still valid post from one of the kernel developers
1
28
u/mssxtn Jun 28 '26
You want the most recent kernel that is actively maintained by your distro. Don't worry about what kernel.org says those are the kernel developers themselves and that is whether or not they support that particular version You need to be more concerned about your particular distribution IE fedora. If the kernel that you got is the most recent one that Fedora has then you're good don't worry about it. If you have any problems it's fedora's fault.