The Linux inside your Android phone, and the date its fixes stop

If your phone runs Android, it runs Linux. Google's own developer guide says it plainly: "The foundation of the Android platform is the Linux kernel." Linux is free, open-source software, and it also runs most websites. The version inside your phone has a published end date. After that date, Google says, devices running that kernel "are considered to be vulnerable."

So the useful question about any phone is a date. Until when does it get security updates?

Android is built on the Linux kernel

The kernel is the core of a phone's software. It talks to the hardware, such as the screen, the camera and Wi-Fi, and shares the processor and memory between your apps. Google says the part of Android that runs your apps relies on the Linux kernel for basic jobs such as managing memory.

Android is not a desktop Linux system. It is built on the Linux kernel, with Google's own software on top.

Google gives its reasons in its security documentation. Linux "has been in widespread use for years, and is used in millions of security-sensitive environments," and through "constantly being researched, attacked, and fixed by thousands of developers" it has become "a stable and secure kernel". Its developer guide adds that a well-known kernel makes it easier for phone makers to write the software for their own hardware.

Since kernel version 5.10, Google splits the kernel in two. Google maintains a common core that is the same on every phone that uses that kernel version. The chip maker and the phone maker supply the parts that talk to their own hardware.

In May 2021 Google said Android had "more than 3 billion active devices around the world". That count includes tablets, TVs and watches, not only phones, and Google has not published a newer one.

The same kernel turns up elsewhere. W3Techs counted on 18 October 2026 that Unix-type systems, the family Linux belongs to, run 92.2% of websites whose operating system it knows, and that Linux runs 68.4% of those. Google TV runs Android, so Linux too. Your office router may also run it, as our router story explains.

A security fix passes through several companies

When someone finds a flaw in the kernel, the fix does not jump straight to your phone. It travels a chain.

1. Linux developers fix it in the long-term version of the kernel.
2. Google adds Linux fixes to its own Android kernels and lists kernel flaws in its monthly Android Security Bulletin, usually published on the first Monday of each month. Google says: "Android partners are notified of all issues at least a month before publication."
3. Chip makers fix their own parts. The September 2026 bulletin says some issues "affect MediaTek components and further details are available directly from MediaTek", and that for others "the severity assessment of these issues is provided directly by Qualcomm."
4. The phone maker puts the fixes into its own update. Samsung says chip-maker patches "may not be included in the security update package of the month" and arrive in a later one.
5. Sometimes the mobile network. Samsung says timing "may vary by market, network provider and/or model", and that "some carriers may only support quarterly updates".

Unless your phone is a Google Pixel, Google does not send the update. Your phone maker does.

Every kernel version has an end date

Google publishes how long it supports each Android kernel. Older versions get six years. "Beginning with kernel 6.6, the support lifetime for the stable kernels is 4 years."

• android12-5.10 and android13-5.10: to 1 July 2027
• android13-5.15 and android14-5.15: to 1 July 2028
• android14-6.1: to 1 July 2029
• android15-6.6: to 1 July 2028
• android16-6.12: to 1 July 2029
• android17-6.18: to 1 July 2030

Google sometimes supports a kernel longer than the Linux project itself. kernel.org projects the end of version 5.10 in December 2026; Google keeps its Android 5.10 kernels until July 2027. After Google's date, it says, the kernels "are no longer supported by Google and devices running them are considered to be vulnerable."

Phone makers set their own promises

Google Pixel. Pixel 8 and later phones get "7 years of OS and security updates". Pixel 6 and 7 phones get 5 years. Both count from when the phone first went on sale in the US Google Store, not from the day you bought it. Pixel 5a and earlier no longer get security updates.

Samsung. Samsung extended security support "by up to 7 years" from January 2024, on selected devices. Its monthly list includes the Galaxy S23 to S26 series and some business models, such as the Galaxy A54 to A57 5G and XCover7. Many budget A, M and F models are on its quarterly list, which means fewer updates.

Two things to do on Monday

Before you buy phones for staff, ask the seller: until what date does this model get security updates? Google and Samsung both publish how long their phones get updates.

For phones you already have, open Settings and look for the security patch level. It is a date. Google's September 2026 bulletin says patch levels of 5 September 2026 or later fix every issue it lists. If your phone shows a date many months old, it is behind.

On Friday: Linus Torvalds, who started Linux.