Delivering Security Fixes Continuously Into Your Embedded Linux
summary
Yocto-based EM Linux pulls full upstream SLTS kernels from CIP (10+ year support) and Debian packages via meta-debian to deliver monthly updates and a 10-year maintenance period, with major upgrades every four years (optionally two). Kernel SLTS trees release twice a month, CVE checks (KanoSec + Yocto CVE integration) run automatically, and CI uses KernelCI, Buildbot and LAVA for continuous verification. Strategy: avoid cherry-picking, minimize out-of-tree BSP code, prefer hardware with mainline support to keep updates automatable and affordable.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:45Embedded systems need updates
- 5:23Preparing security updates
- 15:14EM Linux delivers updates
- 24:10Recap and key takeaways for embedded Linux security
- 24:57Q&A: LTS fixes & regression
- 31:29Q&A: Major upgrades
related talks
39mUsing Long Term Stable Kernel for the Embedded Products
49mLong-Term Maintenance, or How to (Mis-)Manage Embedded Systems for 10+ Years
31mDebian and Yocto Project Based Long-Term Maintenance Approaches for Embedded Products
17mSustaining Yesterday’s Linux: Delivering Security for Today’s Workloads
33mUsing Open Source Software to Build an Industrial-grade Embedded Linux Platform...
36mStatus of Embedded Linux
21mFrom CVEs To Compliance: Automating Embedded Linux Kernel Security
42mBoF: The Yocto Project and OpenEmbedded