New elevation of privilege vulnerability discovered in Linux kernel that

The maintenance period for LTS versions of the Linux kernel is reduced from 6 to 2 years due to lack of support and an excessive workload that exhausts maintainers – Developpez.com

New elevation of privilege vulnerability discovered in Linux kernel that
The Linux community announces an important change: Linux kernel Long Term Support (LTS) will no longer be maintained for six years, but only two years, due to lack of usage and support as well as maintainer exhaustion. Although two years of maintenance is sufficient for PCs, it may not be enough for Android and IoT devices that typically do not update their kernels. For example, Android 14 is expected to be powered by Linux 5.4, an LTS version released in 2019. So kernel maintainers say there’s really no point in maintaining versions for so long if people aren’t using them.

Linux enriches private companies while its maintainers work hard

Jonathan Corbet, Linux kernel developer and editor-in-chief of Linux Weekly News, announced this week at the Open Source Summit Europe event in Bilbao, Spain, that a big change is coming: Long Term Term (LTS) support for kernels -Releases are shortened by six to two years. This promises to reshape our approach to long-term system stability. Although this represents a big change, it is actually a step backwards. In 2017, support was extended from 2 years to 6 years. Now, 6 years later, it turns out it’s a lot of work.

The maintenance period for LTS versions of the Linux kernel

The maintenance period includes an active support period and an extended support period during which important security updates and bug fixes are provided. The plan to return two years is not immediate and the Linux community continues to adhere to the current end-of-life deadlines. There are currently six Linux LTS kernels: 6.1, 5.15, 5.10, 5.4, 4.19 and 4.14. Under current procedure (6 years of LTS support), version 4.14 would disappear in January 2024 and another kernel would be added. However, if kernel 4.14 and the following two disappear in the future, they will not be replaced.

In fact, even this six-year window should be optional from the start, because the FAQ on the release page states: “Each new Linux LTS kernel typically begins with an expected end of life of just two years.” This window can be extended if there is enough interest from across the industry to support it over a longer period of time. But the kernel maintainers apparently noticed that LTS versions had accumulated over the years, but only a few people were using them. Corbet also lamented the lack of community support.

Corbet said: “There’s really no point in keeping old kernels around for so long because people won’t use them.” The other big problem is maintainer burnout. He notes that maintainers are often not paid and could benefit from much more support from the multi-billion dollar companies that profit from using Linux. According to him, the developers are not the problem. Recent Linux kernel releases have involved an average of more than 2,000 programmers – including about 200 new developers – working on each release.

Rust would be both a good and bad thing for maintainers

According to Corbet, the situation is different for the maintainers, i.e. the people who check whether the code is adapted and works correctly. Not only do they have to ensure the maintenance of the Linux kernel code, but they also have to fulfill their obligations to their respective employers (which are other companies independent of Linux). In addition, the time required increases due to a lack of staff and the use of fuzzing for troubleshooting. Corbet said that while fuzzing is useful, it ultimately increases the workload of Linux kernel maintainers.

Josef Bacik, developer and maintainer of the Linux kernel file system, says: Maintainers burn out [parce que] Those responsible for maintenance are not scalable. Darrick Wong, another Linux kernel maintainer, added: This can’t last. We need help . At the same time, another difficulty for maintainers lies in choosing Rust as a second Linux development language. More than 30 years after developing exclusively in C, Linux welcomed Rust last year. The project is welcomed and is intended to eliminate certain classes of errors associated with C.

However, Rust is relatively young compared to C, which requires more work from Linux kernel maintainers, some of whom have worked with the C language for 30 years. Additionally, discussions about integrating Rust into the Linux kernel show that some maintainers dislike Rust. They are hesitant to make the language developed by Mozilla the main development language for the Linux kernel. According to Corbet, the issue has not yet been resolved but will be resolved in the near future. For now, Rust continues its core path well and further important additions are planned soon.

So how can caregivers get more support? Corbet suggested that their employers pay them for the work they do maintaining the Linux kernel. According to Corbet and his colleagues, companies that use Linux must understand that if they want to continue to reap the benefits, they must give back to Linux what the kernel gave them. Of course, this suggestion from Corbet is controversial and the subject of debate within the community. Some have pointed out that this is a thorny issue that the Linux kernel community has struggled to solve for decades.

How might the move to biennial LTS releases impact users?

According to analysts, this change will have a smaller impact on PCs. However, it is expected to have a much larger impact on Android devices, smartwatches and other Internet of Things (IoT) devices. These devices tend not to update their Linux kernel “quickly,” so this delay in support could be problematic. On PCs, two years represents the time between kernel updates, which is a reasonable time frame. However, for IoT devices, this duration represents the majority of the development cycle and the entire support window for the consumer.

The maintenance period for LTS versions of the Linux kernel

The deadline is therefore not long enough. According to multiple sources, the original LTS expansion, including the six-year expansion, was designed primarily for Android and IoT devices, taking into account the time required for their development and support cycles. It was announced in 2017 during a conference on Android Linux by Iliyan Malchev, a developer at Google. After the change, the LTS kernel would reach end of life after two years of support once the Android phone finally ships, and customers would be using outdated kernels throughout the lifespan of their devices.

It should be noted that the Android kernel development process is a batch of forks. First, Google takes inspiration from a new Linux LTS to create the “Android Common” kernel, which is then sent to integrated circuit (SoC) vendors like Qualcomm, and a new fork is created for each SoC model. Finally, this fork is sent to the device manufacturers, who recreate it for each device model. This will need time. Google documents indicate that Android 14 will run on Linux 5.14, a 4-year-old LTS version. It is unclear how this change will affect the Android platform.

There are also smartwatches where things seem to be even worse. Google’s Pixel Watch is based on the Linux kernel 4.19. The core was already more than four years old when Google launched the Pixel Watch.

Source: Talk by Jonathan Corbet at the Open Source Summit Europe 2023

And you ?

Tinder travaille sur un new subscription mensuel a 500 dollars What is your opinion on this topic?

Tinder travaille sur un new subscription mensuel a 500 dollars What do you think about reducing the maintenance time for LTS versions of the Linux kernel?

Tinder travaille sur un new subscription mensuel a 500 dollars What do you think of the Linux kernel officials’ reasons for making this change?

Tinder travaille sur un new subscription mensuel a 500 dollars How do you think the Linux community can reduce the workload of kernel maintainers?

Tinder travaille sur un new subscription mensuel a 500 dollars How can the other problems mentioned by Linux developer Jonathan Corbet be overcome?

Tinder travaille sur un new subscription mensuel a 500 dollars Will companies that get rich off Linux be willing to pay maintainers?

Tinder travaille sur un new subscription mensuel a 500 dollars What impact could this shift have on the industry, particularly IoT devices?

See also

Tinder travaille sur un new subscription mensuel a 500 dollars Linus Torvalds releases the Linux kernel 6.5 with support for the MIDI 2.0 protocol in the ALSA software stack, Landlock support and ACPI support for the RISC-V architecture

Tinder travaille sur un new subscription mensuel a 500 dollars Forty years of the GNU operating system and the free software movement by the Free Software Foundation (FSF)

Tinder travaille sur un new subscription mensuel a 500 dollars GNOME 45 “Riga,” a Linux desktop environment, is available with improved search and new themes