Re: Confirmation on EOL for Linux 5.4 Stable Kernel

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Sep 24, 2025 at 04:01:08PM -0400, Joseph Salisbury wrote:
> 
> 
> On 9/24/25 13:41, Joseph Salisbury wrote:
> > Hi Greg/Sasha,
> > 
> > I am reaching out to confirm the projected EOL for the Linux 5.4 stable
> > kernel.
> > 
> > According to the information listed on kernel.org [0], the EOL is
> > currently slated for December 2025. We are using this projection for
> > planning, so we would be grateful if you could confirm it is still
> > accurate.
> > 
> > Thank you very much for your time and for all the work you do in
> > maintaining the stable kernel releases!
> > 
> > Thanks,
> > 
> > Joe Salisbury
> > 
> > 
> > [0] https://www.kernel.org/category/releases.html
> 
> Sorry, I forgot to CC stable for the wider audience.  Doing that now.

Yes, 5.4 will be going end-of-life in December.  Right now, with the
5.4.299 kernel release, I count 1419 unfixed CVEs in that release, which
does NOT include the known CPU vulnerabilities that are not fixed in
that branch as well (kernel.org does not assign CPU bug CVEs).

So if I were to just go off of that number, I would think that this was
already an "unsupported" kernel tree, and would never recommend anyone
use it for anything that is exposed to untrusted users.

Anyway, I understand that's not the business model you all are in, and I
wish you the best of luck maintaining that beast for longer periods of
time.  Hopefully people are throwing large buckets of cash at you to do
so :)

thanks,

greg k-h