I love the little nugget in the mitigations section. You can plug the hole for a normal filesystem, but then FUSE filesystems have an additional problem: "if an attacker FUSE-mounts a long directory (longer than 8MB), then systemd exhausts its stack, crashes, and therefore crashes the entire operating system (a kernel panic)."
If there's one place other than the kernel where truly defensive programming should be applied, it is systemd.
If there's one place other than the kernel where truly defensive programming should be applied, it is systemd.