I absolutely agree and that's exactly my point: although Linus shouldn't be held responsible, when your IoT thermostat breaks, that still doesn't mean the break

I absolutely agree and that's exactly my point: although Linus shouldn't be held responsible, when your IoT thermostat breaks, that still doesn't mean the breakage hasn't been a trickle down result of some technical decision he made at the kernel layer (if it was a kernel bug that caused it anyway). But it's an open source project and he makes the rules and companies have a choice as to whether they want to adopt it. So I would agree that in this hypothetical case, the IoT company needs a custom kernel patch on their device, and hopefully it gets upstreamed. But if all this occurs after your furnace is shot, you're left asking the manufacturer, "Why did you use Linux at all in this product?" You would think they'd then accept responsibility but what if they do try to blame the Linux project and have expensive lawyers to back them up? This all seems to add up to a potential spaghetti mess of blame where the legal model is "doctors and lawyers and bridge builders." In fact I think these problems need to be addressed outside current legal and regulatory systems which frankly can't keep up with the pace of open source software.