Linux-based embedded systems with a lifespan of up to 25 years pose a unique challenge. Not only must they function reliably, but they must also remain secure, maintainable, and adaptable—for decades to come. This article highlights the most important issues and explains how to solve them. It also takes into account requirements from regulations such as the Cyber Resilience Act (CRA) and the NIS 2 Directive, which apply to manufacturers and operators in the commercial sector.

A major problem is the reliance on third-party software, such as pre-selected packages and patches with their configurations in build systems like Yocto. Many external components are not maintained over the long term—at least not necessarily, and certainly not over decades. This complicates maintenance. The solution: mainlining. In this approach, the product is based directly on a vanilla Linux kernel, its drivers, and the required packages. This reduces dependence on vendor-specific sources, whose availability and update cycles are often unreliable. At the same time, you benefit from maintenance by the open-source community. Careful management of patches significantly simplifies the integration of hardware variants. In the event of an unavoidable dependency, it is important to rely on escrow or similar arrangements.

Another key issue is hardware design. Over the course of 25 years, many components disappear from the market. Therefore, it is important to plan for hardware variants early in the development process. At the same time, sizing the hardware poses a critical challenge due to the trade-off between hardware costs and software obsolescence. To delay software obsolescence as long as possible, issues such as post-quantum cryptography and comprehensive feature extensions must be taken into account.

An important aspect is the security and stability of the system. Through targeted hardening—such as selecting secure software packages, an optimized kernel configuration, and disabling unnecessary functions—the attack surface can be reduced. This not only reduces the number of relevant security vulnerabilities but also directly lowers dependencies and maintenance effort. In light of the risk analysis of the economic and political situation, incorporating post-quantum cryptography and strictly separating the cryptography of different markets from one another appears unavoidable.

The presentation is based on real-world experience and uses concrete suggestions to demonstrate how durable embedded Linux systems can be efficiently implemented using well-thought-out strategies and measures. These include:

■ Mainlining to minimize dependencies
■ Hardware variant management to address obsolescence
■ Continuous hardening to ensure security and stability

These measures ensure sustainable, maintainable, and secure systems—and reduce costs and risks in the long term. A defined investment in product development with a lasting impact on the coming decades—predictability in costs and risk.

The Linux community is leading the way—now it’s our turn! Every contribution counts: Let’s start supporting open-source projects today. Whether it’s vulnerability fixes, documentation, or code—let’s get to work!

Short Bio:

Daniel Klawitter is Team Leader and technical expert for embedded Linux applications. He has 15+ years of embedded Linux experience in various industries including automotive, livestock farming and building automation. Daniel brings in a broad knowledge of various industries paired with a pragmatic approach that products must be in time and effort boundaries. His current role covers the safe and secure update of various heating appliances for an expected lifetime of 20+ years and including highly safety relevant gas boilers.