Keeping the linux kernel secure across 10+ RHEL releases
summary
Red Hat maintains fixes across 15+ kernel streams (including real‑time and ELS tails) by running a two‑year‑old kernel sustaining engineering team that backports upstream patches, files Jira trackers, opens draft merge requests, and runs CI pipelines before RHS security advisories. Kernel.org becoming a CNA drives a flood of ~55 CVEs per week, forcing triage, adaptation, conflict resolution and extensive testing on legacy hardware (PPC64, old GPUs). The process enforces a no-regression policy and FedRAMP compliance checks.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:24Linux kernel across RHEL
- 3:10Older RHEL kernels persist
- 6:05Kernel version support complexity
- 8:58Maintenance challenge breakdown
- 10:3115+ kernel streams
- 11:57Kernel Sustaining Engineering team
- 13:24Kernel maintenance skills
- 14:49CVE landscape and Red Hat
- 16:34Kernel.org as new CNA
- 18:23Red Hat’s CVE response
- 20:50CVE compliance challenges
- 22:14Sustaining engineering challenges
- 24:45Demo: backporting process
- 29:03Q&A
related talks
17mSustaining Yesterday’s Linux: Delivering Security for Today’s Workloads
27mAn SRE guide to Linux Kernel upgrades
32mMonsters, Ghosts, and Bugs: How to Choose a Kernel
51m10 Years of Linux Security - A Report Card
34mAn SRE Guide to Linux Kernel Upgrades
30mRHEL Kernel Workflow using GitLab
25mLinux: Where Are We Going
41mThe Kernel Report