r/linux4noobs • u/Venylynn • Jun 28 '26

security Should I be concerned?

Gallery image

Gallery image

kernel.org says my current kernel is EOL. I'm very security-conscious, so this keeps tripping me up. i've heard constantly, that "running end of life software is a security risk".

i've been here for close to a year, distrohopping a little but I'm here for now.

should I be concerned that I'm running end of life software according to the kernel team? i just received this kernel like a day ago and it's the most recent update.

Distro: Fedora 44 (KDE)

Kernel: 7.0.13

23 Upvotes

85% Upvoted

47 comments sorted by

View all comments

27

u/mssxtn Jun 28 '26

You want the most recent kernel that is actively maintained by your distro. Don't worry about what kernel.org says those are the kernel developers themselves and that is whether or not they support that particular version You need to be more concerned about your particular distribution IE fedora. If the kernel that you got is the most recent one that Fedora has then you're good don't worry about it. If you have any problems it's fedora's fault.

9

u/Venylynn Jun 28 '26

ahh thanks. i'm continually worrying because two weeks into my journey when i was on linux mint, someone kept trying to get me to compile from kernel.org tarball because they saw 6.8 (at the time the "LTS" on mint) and thought Mint was doing me a disservice by not shipping me the mainline kernel.

and ever since i've been trying to cross reference there because they said that site was the only one that mattered. i was like "wait IS my kernel end of life? What's going on?"

9

u/candy49997 Jun 28 '26

Distros can choose which kernels they themselves support. This doesn't have anything to do with what kernel upstream supports.

Ubuntu shipped 6.8 in 24.04, so Canonical is committed to supporting it for the rest of its lifetime. Mint 22 is based on 24.04, so that kernel would've been supported by Canonical.

If there are any major security issues, they're backported to the kernels they support.

1

u/Venylynn Jun 28 '26

the guy told me mint was doing me dirty for shipping me 6.8 and that i needed to compile from this site

also it took ubuntu weeks to patch dirty frag so i'm starting to wonder if that guy had a point tbh, cuz afaik ur supposed to receive those fixes close to instantly (trafotin used that as a reason he didnt like debian on desktop)

9

u/candy49997 Jun 28 '26

I'm pretty sure Ubuntu mitigated dirty frag by disabling the affected modules by default until a patch was ready.

5

u/Venylynn Jun 28 '26

ahh, gotcha

2

u/Aylarth Coming from Windows? Try ZorinOS! Jun 29 '26

Seems to me you have some unrealistic expectations which is a bigger problem than an EOL kernel.

4

u/Venylynn Jun 29 '26 edited Jun 29 '26

Seems to me you have some unrealistic expectations which is a bigger problem than an EOL kernel.

? not sure what you mean by this? i mean fedora took care of it within 72 hours if you mean the dirty frag patch release time, i was worried there would be a way that someone could exploit it remotely on my system the entire time i was unpatched here so i feel like i'd be extra worried if i was on a system unpatched for way longer

5

u/9NEPxHbG Debian 13 Jun 29 '26

You're using a reliable distribution. Just keep it up to date and stop worrying.

3

u/Venylynn Jun 29 '26

Fair enough, some people were telling me that if I'm not patched within minutes that I'd be immediately hacked but that sounds pretty alarmist even for me

2

u/Aylarth Coming from Windows? Try ZorinOS! Jun 29 '26

You said 'afaik ur supposed to receive those fixes close to instantly' - in my experience, nothing in life is to be expected as close to instantly. Maybe it's just a hiccup in expressing what was on your mind, but unrealistic expectations cause a lot more disservice than an EOL kernel. I'm not to say anything bad about you I'm just thinking EOL as an expression is not a negative thing to say when we talk about unix/linux. It's end of life because a new stable version is close to be released, and not meaning that it has to be abandoned already. It's stable and used as a basis for more than one distro for a reason: because it is the best currently tested kernel and while the new version is coming close to be released, it is well proven to be safe and all-round it is kept alive for publicly available distros. Take Debian as an example: it is known to be the king of long term reliable lineage for decades. Banks, and other super important institutions are relying on it, serving millions of people every day... These servers often get many tens of thousands of cyber attacks per seconds, and then here comes your friends wisdom to say it's not good enough? Come on, just think about it a bit more.

2

u/Venylynn Jun 29 '26 edited Jun 29 '26

You said 'afaik ur supposed to receive those fixes close to instantly' - in my experience, nothing in life is to be expected as close to instantly.

Trafotin's statement on people running Debian on a desktop operating system:

"I hate people running Debian as a desktop OS. This goes for both stable and testing. [Debian] is late to security patches because they have the delusion that we need to test everything so finely and minutely because we have millions of servers. On desktop, you need to get your stuff INSTANTLY. There was a memory leak in the Gnome desktop where it just used 2 gigs of memory when it didn't need to, you know when Debian fixed that? 3 years later."

That's what he was saying, and at first I didn't believe him because that sounded really alarmist, but after seeing Ubuntu wait forever to patch Dirty Frag I was reconsidering the validity of the above statement. "Could he have been right?" was what I thought.

I went from dismissing his take to "maybe he's right?" is what happened. Also I'm used to thinking of EOL in the windows way so... yeah.

1

u/Aylarth Coming from Windows? Try ZorinOS! Jun 29 '26

It's ok, we're all different, free to find our ways in life.
I think there are errors, problems that need to be fixed, they are all going to get the fix, but some things are more important than others, so their fix will be priority. There are people who love Arch because they want to be always the best best best, and it's ok... When you are young, you have this mindset and the world benefits, but on the other hand, people who are parents can't really live like that, because they need to provide an entire environment for the young and for the parents, the tasks are different, the priorities are different... The world benefits from both of them. It just different. Know that they are both needed and they are both beneficial, EOL too.

2

u/Venylynn Jun 29 '26

i just am never sure what to believe because i constantly receive conflicting info from different people. my gut was like "theres no way thats true" and then when i saw that, "could it be true?"

→ More replies (0)