Overview
This series traces how Linux kernel baselines move from SoC SDKs through ODM/OEM integration into SOHO routers and IP cameras, creating vulnerability debt when old lines are inherited. It separates version-based CVE associations from source- and build-aware inference, compares upstream support timing with shipped firmware, and examines detachment, maintenance, community firmware, users, and compliance. It helps readers judge lineage, supportability, update security, and responsibility without treating study measurements as a market census or source findings as proof of exploitability.
Learning outcomes
- A firmware date or signed delivery channel does not prove that a device’s kernel foundation is current or maintainable.
- Version-only CVE counts can greatly overstate exposure in customized firmware; source and build evidence narrows attribution but cannot prove exploitability.
- Reused SDK baselines can spread maintenance debt across products, and upstream end of life can precede SoC or device release.
- Responsibility is shared: SoC vendors shape leverage, integrators and vendors choose whether to inherit, and communities or rules help only where access and evidence reach.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
Does a router firmware update mean its Linux kernel is supported?
No. A firmware update can change a service, configuration, or feature while preserving the same SDK kernel; signed delivery protects installation, not ongoing kernel maintenance.
Why are version-based CVE counts unreliable for SOHO routers and IP cameras?
They map a general kernel line to all associated CVEs, including code the device may not build or expose. Source and build analysis narrows the inference, but it still does not prove runtime exploitability.
How can an old kernel become vulnerability debt across devices?
An SoC SDK can reuse the same kernel baseline across many products, so an end-of-life line creates recurring work to backport fixes, validate them, or migrate. Shared lineage does not mean identical vulnerabilities.
Who is responsible for an inherited router or camera kernel?
Responsibility is shared: SoC vendors choose influential SDK baselines, integrators decide whether to inherit or detach, and device vendors accept, ship, and support the result. Communities and regulators can widen options or visibility but cannot guarantee coverage.