That's why you run a trusted Linux distro in production, like sles or rhel or ubuntu, their core value proposition is _exactly_ this: Provide binary compatible

That's why you run a trusted Linux distro in production, like sles or rhel or ubuntu, their core value proposition is _exactly_ this: Provide binary compatible drop in replacement security updates for shared objects over the lifetime of the platform. They even maintain kernel internal abi compatibility for the released and maintained product, so your exotic-hardware.ko module doesn't need to be updated. Also there is mature tooling around ABI compliance checking: https://lvc.github.io/abi-compliance-checker/ https://lvc.github.io/abi-compliance-checker/ This is used to document the ABI stability of mature projects like so: https://abi-laboratory.pro/index.php?view=tracker https://abi-laboratory.pro/index.php?view=tracker E: re thoughts and prayers, the mature Linux distro all run extensive revalidation for their security updates. Breaking customer binary applications with a security update is the absolute worst case scenario. For yocto or similar cost free projects, or Linux distros that are source, not binary, that may be a different story. But for sles, rhel, ubuntu it's not thoughts and prayers but a maintenance verification and release process on their side and a monthly bill on yours.