This is a problem with LTS distro kernels in general. You're trading the feeling of stability at the kernel level for security updates.
LTS distros can track the LTS kernels and they’ve all been updated
For Ubuntu it was _all_ their kernels though...
This is not a problem with Debian LTS, you’re getting timely security updates. Debian fixed this vulnerability three weeks ago within two days: https://www.debian.org/lts/security/