Unused Kernel Features Create Hidden Vulnerabilities in Linux Systems

Recent kernel exploits targeting the rarely-used IPSEC/ESP module reveal how Linux distributions' default installation of unnecessary kernel features expands the attack surface for all users. By making infrequently-used modules like IPSEC optional rather than installed by default, distributions could significantly reduce the impact of future vulnerabilities on systems that don't need these features. This highlights a critical gap between current kernel deployment practices and fundamental security principles like attack surface reduction.