Yeah, I turned out to be slightly misinformed. The kernel sources had a fix for a while now and fast moving distros like Arch immediately picked them up. But nobody except the kernel devs was told about the vuln and so nobody expedited deployment of a fixed kernel. Ouch.