This article by Bruce Schneier is sobering, and it applies to most of us building embedded systems. Some of us may get security updates via repositories (e.g. Ubuntu), but generally you won’t get new kernels this way. How many Beagle-ish systems are out there attached to the Internet, but with ageing kernels and unpatched for a long time? How can we manage this better in the future?
Anyway, have a look at https://www.schneier.com/blog/archives/2014/01/security_risks_9.html .
Martin
Well if your running my images, ping the server to get the updated kernel's..
beaglebone:
http://rcn-ee.net/deb/saucy-armhf/LATEST-omap-psp
device tree beagle xm:
http://rcn-ee.net/deb/saucy-armhf/LATEST-armv7
Regards,
you can update whatever you want on-the-fly at a embedded system, but to enable these updates you must reboot the system. Sometimes (usually) embedded systems work years without reboot. Who cares about “old kernel”? 
It must be stable first of all and only after that super-new-features matter
It's a reasonable bet that in 2014, most desktop systems have automatic
upgrades turned on (or they're at least actively managed by someone). By
contrast, when was the last time you upgraded the firmware on your router?
Your TV? And in a few years, your fridge/light bulbs/running shoes/bathroom
scales?
Turn it around: if you're shipping a device with an embedded system
connected to the net, do you really want to enable automatic downloads of
new kernels? What if the upgrade fails? Do you provide a way for the user
to fix it ("short the reset pins on your light bulb..." - good luck getting
that one to market!), you issue an RMA or you suffer a reputation for
unreliability? All of those cost money. Schneier talks a lot of sense.