Mitigation code available
A 9.8 in the kernel's IPv4 TCP path, no fixed kernel for any Ubuntu release and a tracker page that lists no mitigation. The fix you cannot install yet still tells you what the bug needs, and what a bug needs can be taken away.
The IPC objection to microkernels is fair, and it is the wrong place to stop the conversation, because what it buys you is a fault boundary that a monolithic kernel cannot sell at any price.
CFS gave way to EEVDF over 6.6 to 6.12. Most people who tune a scheduler are solving a problem that isn't a scheduling problem, and the cases where it really is are narrower than the tuning guides let on.
The verifier is the whole story, and you learn more from what it turns down than from what it waves through. A boundary built out of static analysis; you pay at load time and it is free thereafter.
WireGuard shipped in Linux 5.6 at roughly 4,000 lines, against OpenVPN's hundred thousand and more. The size is the security argument; it isn't a happy side effect of one.
Speculative execution was the free lunch of CPU design for twenty years, and it leaks straight across the privilege boundary everything else was built on. This is the week that will explain the next decade of isolation work.
Control groups shipped in Linux 2.6.24 in January 2008 and spent six years as plumbing almost nobody touched. The v2 rework is already under way now that containers have made the subsystem famous.
Docker hit 1.0 last week. What is spreading is a packaging format and a registry rather than a new isolation primitive; cgroups and namespaces have been in the kernel for years. The distinction matters, because the isolation we have just traded away is going to have to come back.
