CruelKernel uses common security patch date to be in sync with the official twrp and samsung firmware. You can check the default os_patch_level in cruel/build.mkbootimg.* files. However, this date can be lower than other kernels use. When you flash a kernel with an earlier patch date ...