Things are more complex when requirements and documents were drafted time ago. A requirement may specifically include all security updates asap for that softwa

Things are more complex when requirements and documents were drafted time ago. A requirement may specifically include all security updates asap for that software on that version and it is nobody's interest to change kernels (especially by who charges the clients for this routine constant work).