Three software engineers from CIQ, a Linux company, have found that the kernels shipped by commercial firms have more unpatched flaws than the upstream stable kernel which is maintained by Linux developer Greg Kroah-Hartman.