Security fix advisory

Came across this advisory:

Are balenaOS in the risk zone for this type of attacks?

Since all current Linux kernels are affected, also balena devices are affected by this. But to actually take advantage of the attack, one needs to be able to send TCP packets to the device, so for example if a device is not exposed to the internet directly an attacker would have to be in the same network as the device. Our public URL feature is also not affected by this, because it operates one OSI layer above.
We are already looking into this and how to include the kernel patches in the next BalenaOS releases, and if/how we can protect current devices.