Copperhead maintains the -hardened patchset, which is essentially a fork of Grsecurity, largely because of those concerns. (I don't use CopperheadOS on my phone, but I do use their work in the form of linux-hardened on my desktop!)