Yup, and with that, welcome to the world of semi-proprietary ARM development boards. Leave security patches at the door, and enjoy your version 3.5 kernel for a

Yup, and with that, welcome to the world of semi-proprietary ARM development boards. Leave security patches at the door, and enjoy your version 3.5 kernel for as long as the hardware lasts! Joking aside, I think a lot of this comes down to the incentives (or lack thereof) in the ecosystem - there is no real penalty for releasing an insecure product, or one that can't be kept up to date. Thus inventivising shipping on an outdated kernel you can't maintain, and never patching it. If those shipping products had to factor in the externalities of this decision, they would rapidly be mainlining everything to reduce the costs of this. The cost of "mainlining" their code will be trivial compared to the (unmeasured) cost of the disposal of the equipment during a reasonable lifespan due to lacking updates, and the replacement of the equipment.