Free tools Windows power users keep installed
One-click scans. No signup required.
Start by checking the security advisory for your exact Linux distribution and release, then map its affected and fixed packages to the hosts you actually run. A CVE number alone does not tell you whether a host is vulnerable. Install the vendor’s fix through your normal update process, but remember that an installed kernel is not necessarily the kernel currently running: when the running kernel must change, schedule a reboot unless a vendor-supported live patch specifically covers the issue.
What should you do first?
Before changing hosts, establish the scope and the source of truth. Create a response record for the CVE, then inventory systems against the vendor advisory. This prevents a headline, severity score or upstream kernel version from being mistaken for a host-level applicability decision.
- Capture the alert: record the CVE, publication details, vendor advisory IDs, reported severity and any evidence of active exploitation.
- Identify the affected software: note the distributions and releases covered by the advisory, along with its affected and fixed package information.
- Inventory candidate hosts: for each system, capture its distribution, release, architecture, kernel flavor and running kernel.
uname -ris a common starting point for the running version, but it does not by itself establish whether the host is affected. - Set an owner and deadline: assign someone to determine applicability and track the fix, reboot or exception for each host.
Use a vendor-defined affected version range or stable commit/version identifier when comparing upstream kernel information. “Latest mainline” is not a precise basis for deciding whether a distribution’s kernel is affected.
How do you tell whether Ubuntu, Debian or RHEL is affected?
Check the advisory and package status for the specific distribution and release installed on each host. Distributions can backport fixes or assess an issue differently from upstream, so comparing only the version string with a generic upstream version can give the wrong answer.
#1 Best Overall
- Ubuntu: consult the release-specific Ubuntu Security Notice and package status. Ubuntu publishes OVAL data for determining whether an update applies and auditing fix presence; it also documents OVAL, OSV and VEX feeds for automated checks.
- Debian: use Debian’s security tracking for the relevant release and package. Debian’s security team maps CVEs to Debian packages and evaluates their impact in Debian’s context; assignment of a CVE does not automatically mean every Debian installation is vulnerable.
- RHEL: use the advisory and package information for the applicable RHEL release and kernel flavor. The cited RHEL live-patching guidance does not establish that every critical or important CVE is covered by live patching, so check coverage for the specific issue rather than inferring it from severity.
For each host, keep a concise decision record: affected or not affected; fixed package available or pending; live patch eligible or not; reboot required or scheduled; owner; and deadline. If the advisory does not cover the host’s release or package clearly, keep the status unresolved and ask the distribution’s support channel rather than treating uncertainty as a clean bill of health.
How should a small team prioritize the patch queue?
Severity is one input, not the whole ordering. Consider exploit evidence, network exposure, privilege impact, business criticality, compensating controls and the vendor’s priority. Ubuntu says its priority assessment takes account of severity, importance, risk, estimated affected users, software configuration and active exploitation. Debian likewise cautions that a CVE identifier alone does not establish a serious threat in every Debian context.
| Queue order | Typical systems | Why they rise in priority |
|---|---|---|
| 1 | Actively exploited issues and internet-facing systems where the vulnerability enables privilege escalation or another material compromise | Exploit evidence and exposure can make delay especially consequential. |
| 2 | Exposed production systems, identity services and virtualization hosts | A compromise or outage can affect important services or many workloads. |
| 3 | Internal systems with elevated privileges or sensitive data | Limited external exposure does not remove the potential impact of access to privileged systems or data. |
| 4 | Lower-exposure development and lab systems | These may follow higher-risk hosts when their exposure and business impact are lower. |
Record why a host is deferred, who owns the exception and when it will be reviewed. Re-rank if exploit evidence, exposure or vendor guidance changes.
How do you stage and install the vendor fix?
Use the fixed kernel package from the official distribution repository or your approved configuration-management pipeline. Avoid treating an upstream build or an unreviewed package as interchangeable with the supported distribution fix.
- Choose a representative non-production host and apply the update through the same process intended for production.
- Validate boot, storage, networking, workloads, monitoring and any third-party kernel modules relevant to that host.
- Move to a small production canary. Confirm application and system health before expanding to the rest of the fleet.
- Keep the previous kernel available according to the distribution’s supported rollback procedure.
- Record the package transaction, target kernel build, advisory IDs and result for each host.
A successful package transaction proves that a package was installed; it does not prove that the host has booted into it. Keep package state and running-kernel state as separate checks.
Should you reboot or use live patching?
Live patching can reduce downtime for eligible kernel fixes, but its coverage depends on the distribution, release, kernel flavor, subscription and specific vulnerability. Treat it as a scoped risk-reduction measure, not a blanket substitute for ordinary kernel updates.
Rank #4
| Decision point | Kernel update plus reboot | Live patching |
|---|---|---|
| Coverage | Uses the fixed kernel package supplied for the applicable distribution and release; follow the vendor advisory. | Only applies where the CVE, release and kernel flavor are eligible. Not every important or critical issue is covered. |
| When protection takes effect | The new kernel must be running; if the running kernel needs to change, a reboot is required. | Can apply an eligible fix to the running kernel without rebooting, subject to the vendor’s coverage and state checks. |
| Maintenance impact | Requires a maintenance window or an operational plan to reboot safely. | Can avoid an immediate reboot in eligible cases, reducing downtime pressure. |
| Requirements | Use the supported package source and the distribution’s normal update and reboot process. | Confirm the applicable service, release, kernel flavor and subscription. Canonical Livepatch is part of Ubuntu Pro. |
| Does it replace a normal kernel upgrade? | It is the path for activating a newer kernel when the vendor requires that upgrade. | No. Canonical says live kernel patching is insufficient when upgrading to a newer kernel is necessary; that case requires a reboot. Some code paths cannot be safely live-patched. RHEL guidance also warns that not every critical or important CVE is resolved through live patching. |
Before relying on a live patch, verify that the specific CVE and host are eligible and that the patch is active. If the vendor requires a newer kernel, plan the normal update and reboot even if live patching has reduced immediate exposure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do you reboot safely?
- Schedule a maintenance window appropriate to the service and notify stakeholders.
- Drain traffic, fail over workloads or otherwise reduce service impact using the system’s operational procedures.
- For a cluster, reboot one node at a time. Confirm quorum and application health before moving to the next node.
- Reboot the host and verify that it returns healthy, including its workloads, monitoring and relevant services.
- If live patching was used as an interim measure, track any outstanding reboot requirement until the normal kernel update is activated.
How do you prove remediation?
Retain evidence that connects the advisory to the package and the kernel actually executing on each affected host. A package database alone cannot show that the machine has booted into the fixed kernel.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Best Value
- CVE and vendor-advisory identifiers.
- Distribution, release, architecture and kernel flavor.
- Kernel package versions before and after the update.
- The running kernel version after reboot, checked with
uname -ror an equivalent method. - Live-patch status and any reboot-required flag.
- Package-manager transaction logs.
- Service, monitoring and workload validation results.
- Exceptions, deferred hosts, their owner and deadline, and the rollback plan.
Ubuntu’s OVAL and OSV data can support automated checks, but those checks should preserve the distinction between an installed package and the kernel currently running. Close a host’s remediation record only when the evidence shows the applicable fix is present and the required activation step has been completed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
