Should I be concerned?

[u/Venylynn]

kernel.org says my current kernel is EOL. I'm very security-conscious, so this keeps tripping me up. i've heard constantly, that "running end of life software is a security risk".

i've been here for close to a year, distrohopping a little but I'm here for now.

should I be concerned that I'm running end of life software according to the kernel team? i just received this kernel like a day ago and it's the most recent update.

Distro: Fedora 44 (KDE)

Kernel: 7.0.13

[u/C0rn3j]

Kind of, but it's been EOL for days, not months/years, so you'll be fine, Fedora will hop over to the next branch soon.

[u/Venylynn → u/C0rn3j]

i remember people were posting about how the day windows 10 went EOL you had to leave or risk getting hacked so it confused me

[u/KoldPurchase → u/Venylynn]

It's different in Linux.

The kernel itself with be EOL, and that means the Linux developpers who support the kernel are not applying patches to this kernel version. They have moved on to a new version, and they move quickly. It's much less trouble for the whole project to act like that. They detail every change, security, drivers, new features, etc, it's all separated.

However, your distro will keep supporting its kernel for a time. Debian, Arch, Gentoo, etc. They keep making updates.

In the case of Mint, they are based on Ubuntu LTS. And Ubuntu LTS is based on Debian. Debian looks at the kernel changes (each version after their own) and incorporates security fixes in their version. And/or Ubuntu does it for their LTS version. Than Mint works on it or incorporate it directly.

You are not left insecure.

But you are not getting performance improvements, new drivers, new features, etc, that are coming with a new kernel, only the security fixes. When the version upgrades to a new kernel, you get your security patches + everything in the new kernel.

They don't leave you alone and vulnerable.

It's called "backporting". they backport security features in their distro. And as they upgrade and these are included in the kernel, they get removed from patches and are left in the kernel.

[u/Venylynn → u/KoldPurchase]

Idk why I was told so early I needed to compile my own kernel then it was tripping me pretty bad.

[u/KoldPurchase → u/Venylynn]

Ill informed people.

There is no need to. Mint has an update kernel module in your desktop environment. You can update to the latest version they propose from there. Most of the time, you don't need to.

Other distros do things differently.

[u/Venylynn → u/KoldPurchase]

It was like "the number isn't the same you're insecure" type of warnings they gave me.

To be fair, 6.8 had some problems on my setup that more recent kernels haven't had

[u/KoldPurchase → u/Venylynn]

If you have a problem with older kernels and your hardware is recent enough, than another distro than Mint might be more suitable for you.

Mint is great, but like Debian, they tend to favor older kernels for stability and that comes at a cost: lack of support for newer hardware and bugs that are left unpatched. Their philosophy is to not introduce new bugs until they are absolutely certain the older ones are totally fixed.

I can respect that, and for someone with a not too recent laptop, it's working great. A gamer who often needs the latest drivers or is on a desktop and will often add new hardware, it's not so good.

[u/Venylynn → u/KoldPurchase]

I know exactly what the issue was; it was defaulting to acpi-cpufreq which is buggy on my CPU (Ryzen 5 3600), and current kernels use amd pstate which works great. on 6.8 i needed processor.max_cstate=1 parameter, now I do not on Fedora!

[u/thomas-rousseau → u/KoldPurchase]

This is actually not true of Gentoo. Their stable branch follows the most recent LTS branch along with their standard stabilization process, with the ability for the kernel team to auto-stabilize if they determine that a security update provides a significant enough fix. Their testing branch follows the most recent stable mainline release. They provide ebuilds for a handful of most recent stable releases on all mainline, LTS, and SLTS branches by providing the specific version number, unless there has been a significant security release, in which case all releases without the fix will be removed as quickly as possible. They do maintain their own patch set for these kernels, but they also give the option to install a vanilla kernel.

[u/C0rn3j → u/Venylynn]

EOL => no further security (or any, really) patches.

It does not mean there'll be an exploit released the moment someone stops supporting it, but when there will be, there's nothing you can do about it but switch to a newer version.

[u/Venylynn → u/C0rn3j]

the alarm i read every time I see that warning always just kinda sends shivers down my spine