what security fix?

Actually, I think it would be nice to have a version of the -stable patches which only updates a version number that's not in a file used by the build system. That way, you'd be able to apply the patch to your source tree and it would only rebuild anything if it affected code that you build.

Then everybody would want to apply the patch, since either it would provide a benefit (either stability or security) or it would not require any downtime to apply. For that matter, it would be nice to have a make target that wouldn't recopy modules that hadn't changed, and an lsmod flag to show modules which are different on disk from what's loaded.