Post #3863896

Note that there's a variant on the above already possible without any new programming. It goes like this: Run the system you actually care about, with your userspace and applications exposed to vuln surface, as a virtualization guest using virtual devices and a fixed LTS kernel version you trust. Run the dubious kernel with new stuff as the hypervisor not exposed to any networks or untrusted files. This isn't entirely perfect. It's still possible that bugs in the drivers on the hypervisor side put you at risk. But at least bugs in the "OS" part of that Linux become irrelevant, because you're not using it.