Our port of the 10th generation Pixels to the Linux 6.18 GKI LTS branch has been through a day of public testing by a couple dozen users. There are no known issues remaining anymore. We're going to continue heavily reviewing the commits and looking for more unhandled API changes.
0 Boosts
0 Likes
Our plan is to port 6th through 10th generation Pixels to Linux 6.18 to entirely phase out requiring the older kernel branches. Having a single kernel branch across all of the supported devices will greatly simplify shipping upstream LTS revisions and hardening the kernel.
Linux has a massive number of serious security vulnerabilities being discovered with AI models. Most of these vulnerabilities have been present in the kernel for a long time. The average lifetime for vulnerabilities has started dropping significantly after many months of this.
@GrapheneOS The amount they're going to introduce as google goes full vibe-powered is going to negate these gains.
Newly introduced vulnerabilities are being discovered and fixed at a much faster rate. The massive flood of vulnerabilities being discovered and fixed means the backports to older LTS branches are increasingly incomplete. Following the 6.18 LTS branch is by far the best balance.
Linux will have a new LTS branch before the end of the year. That will need time to get stabilized and for many newly introduced vulnerabilities to be found and fixed. We'll move to that from 6.18 once we decide the new backports outweigh additional attack surface and new bugs.
@GrapheneOS
Is there any reason to chose 6.18 over 6.12?
6.12 is a "Super LTS" with declared 10y support, so even longer than 6.18
@wod0bow A significantly smaller portion of the security fixes are backported to 6.12 than 6.18. It also has fewer security features. It's going to get much worse. Even the 6.18 LTS is not good enough but it's the only option until the next LTS gets stable enough and many new vulnerabilities fixed after at least months of it being available.
We plan to move on from 6.18 to the next LTS branch before the end of 2027. We'll continue moving to the newer LTS branches. We aren't sticking to one.
@GrapheneOS @wod0bow awesome thread guys! So to conclude, you'd say 6.18 is the most "secure" branch? Or it's not that simple? I'm thinking of my Debian 13 laptop.
@funkybuddha @wod0bow 6.18 LTS branch is currently the least insecure option when considering the different tradeoffs. It will take a while before the next LTS branch takes that position. The new vulnerabilities need to be ironed out.
Debian isn't a good choice if you care much about security for multiple reasons though. The approach used by Fedora is far more reasonable balance where they do update to new point releases throughout a release and has two releases per year.
Only a single regression was found during the past day of testing. DisplayPort alternate mode wasn't working due to Linux switching from a 32-bit read to a 16-bit read to match the size of an SVID. It was fixed by changing "<0xff01>" to "/bits/ 16 <0xff01>" in the device tree.