Embed Notice

A realization: One way to describe the Linux kernel CVE situation is that the Linux kernel developers aren't going to be providing security analysis of bugfixes (or kernel changes in general) any more, especially for unsupported kernel versions. This is not quite accurate; some fixes will certainly come with a security analysis (eg, ones reported to the kernel as unfixed security issues). But fewer will than before.

Is this bad? Well, the analysis before was not infrequently wrong, so.