I thought I had read that incorrectly in previous reports, but I guess not. Which major distributions still have supported releases running 3.7?! I'm guessing it's gotta be RedHat and older Ubuntu LTS releases? Everything I currently have access to seems to be running at least the 4.x series.
So the most vulnerable would probably be legacy systems or old servers riddled with technical debt?
No, RHEL 7 and thus CentOS 7 ship with kernel 3.10 (see https://en.wikipedia.org/wiki/RHEL and https://access.redhat.com/articles/rhel-limits).
You mean the systems that run our banking infrastructure? The systems that run the power grid? Or the ones that run in embedded devices?
Perhaps the Russians intentionally targeted an older version knowing that our most important systems are often legacy and old.
Running an old, battle hardened kernel that gets the occasional bug fix/security patch is about as stable as you can get in software.
Systems are as stable as their most vulnerable components. I don't think that's a contentious notion at all.