[$] Managing the kernel CVE flood

We recently looked at how the kernel community is dealing with the firehose of vulnerability reports, but said little about how users of the kernel are responding. At the 2026 Linux Plumbers Conference, Amazon employees Dylan Johnson and Justinien Bouron discussed the problem from the point of view of engineers trying to keep AWS running and secure in the face of a storm of CVE disclosures. The kernel community's longstanding advice is to run current kernels, and that turns out to work — sort of.