You make a good point here -- the time-to-deployment is significant as well as the time-to-resolve.

It's also true that once a fix is available in any Linux source tree, advanced users can begin to use it from that moment onwards.

Arguably some users could develop their own workaround or solution even before one is available upstream, should they want to (because the code and tools to compile it are all available to them).

(similarly it'd be valuable to analyze how long it takes for the majority of end-users to upgrade across common operating systems. something like this chart[1] of Firefox version traffic history, but for security fix rollout)

[1] - https://web.archive.org/web/20201220010043/https://paulcalva...

Sure - there is definitely a real benefit for advanced users of the Linux kernel.

Epecially if your organization has someone on the Linux kernel security team, I guess.

This can also be a downside where the fix reveals the vulnerability and it begins to be exploited before distros get fixes out.

Iirc there recently was a big one where the fix was snuck into a large Linus patch and not revealed until all distros had a chance to release updated kernels.