> It's been five years and not one single damn person has been a confirmed victim of it yet Well, everyone patched things pretty aggressively, so exploitation

> It's been five years and not one single damn person has been a confirmed victim of it yet Well, everyone patched things pretty aggressively, so exploitation isn't really practical. At minimum, that's why. Also, vuln research can take a long time to turn into exploits - there are so many existing primitives that people are exploring right now (ebpf, io_uring) that have practical exploitation primitives already designed, so there isn't much pressure to go for something that's already patched and that would require a lot of novel research to find reliable primitives for it. As for the mitigations, just disable them? They're on by default because Linux doesn't know what your use case is, but if your use case isn't relevant to the mitigation's threat model please feel free to disable them. It is very simple to do so.