Recommended Free Tools
To apply a Linux kernel security update safely, use the supported package manager and repositories for your exact distribution and release, review the proposed changes, plan a recoverable reboot, then verify the kernel that actually started with uname -r. Installing a kernel package does not, by itself, make that kernel the one currently running.
Before updating: identify the system and its update source
First record the distribution, release, architecture, and whether the machine is a desktop, local server, cloud image, or remote production host. Confirm that the release is supported and that its kernel comes from the distribution’s or vendor’s supported repositories. Kernel package names and update commands differ across distributions; do not mix Ubuntu, Debian, and RHEL instructions.
Security maintenance also varies by release and package component. Check the relevant vendor’s release guidance and security advisories to establish what applies to your system. A kernel version string alone cannot determine whether a particular vulnerability is fixed.
Review and install the update with your distribution’s tools
Refresh package metadata and inspect the proposed changes using the normal package tools for the host. Follow local change-control procedures, especially on production systems. Install the security update from supported repositories rather than substituting an arbitrary upstream kernel build; a custom kernel can change support and boot expectations.
#1 Best Overall
Ubuntu
Use Ubuntu’s supported package and security-maintenance channels for the specific release. Coverage depends on the release and package component, so check Ubuntu’s security information for the applicable details. Ubuntu Livepatch is separate from APT security updates; enabling it does not enable automatic APT updates.
Debian 13 (trixie)
Debian 13’s release notes describe apt and linux-image packages. If an appropriate linux-image metapackage is not installed, the notes recommend selecting one so future upgrades bring in updated kernels. Check the installed metapackages and choose the package appropriate for the machine. These release-specific instructions should not automatically be applied to other Debian versions or customized kernels. See the Debian 13 release notes.
RHEL 9
Red Hat documents RHEL kernel packages as RPM packages managed with DNF. Use the version-specific RHEL 9 kernel documentation and relevant Red Hat security advisories to check package state and follow the supported update procedure. Do not copy commands or package names from another distribution.
Plan a reboot that you can recover from
A normal reboot is generally required for a newly installed kernel to become the running kernel. Before scheduling it, review the distribution’s pre-reboot guidance and prepare for the possibility that the host may not return cleanly.
- For a remote host, confirm access to a console or provider recovery environment.
- Check bootloader defaults and ensure you know how to select a previous bootable kernel if needed.
- Identify service dependencies and confirm how to restore network connectivity and essential workloads.
- Schedule a maintenance window, notify affected stakeholders, and make sure recovery or workload restart procedures are available.
Debian’s release guidance discusses pre-reboot considerations. Its security manual also gives historical guidance to verify a successful boot and restored networking after a remote kernel update; the general operational concern remains important even when using a different distribution.
Verify the kernel that is actually running
- After reboot, check the running release: run
uname -r. - Compare it with the expected package: use the distribution’s package information and release documentation to identify the kernel version the update installed.
- Check host health: confirm essential services, storage, and network connectivity recovered.
- Investigate a mismatch: if
uname -rstill shows the earlier release, the host did not boot into the newly installed kernel. Check reboot state and boot selection using the distribution’s documented procedures.
On RHEL 9, Red Hat documents how the uname -r release corresponds to the kernel RPM. Even there, interpret the string alongside package details and release documentation. Distributions can backport security fixes, so a version comparison alone is not a complete security assessment. To determine whether a specific CVE is remediated, check the relevant vendor advisory and installed package state.
Rank #4
When live patching can—and cannot—replace a reboot
Live patching can apply selected kernel fixes without immediately restarting the system, but support and scope depend on the distribution, kernel build, and vulnerability. Canonical says its Livepatch service covers selected high- and critical-severity vulnerabilities on supported Canonical-released kernels. It does not turn on automatic APT security updates. Kernel upgrades, driver updates, non-security fixes, performance improvements, new features, unsupported cases, and vulnerabilities that cannot be live-patched may still require a package update and reboot. Service notices may also indicate that a reboot is required.
Canonical states: “Live kernel patching is not sufficient when you need to upgrade your kernel to a newer version — a reboot is required in that case.” See Canonical’s Livepatch documentation and its explanation of Livepatch scope. Do not assume Canonical’s eligibility rules apply to other distributions or kernel builds; check the relevant vendor’s supported-kernel list and service notices.
Quick Recap
Best Value
Choose the verification evidence that answers your question
| Question | Useful evidence | What it establishes |
|---|---|---|
| Which kernel booted? | uname -r after reboot |
The release of the kernel currently running; not, by itself, whether a CVE is fixed. |
| Was the update installed? | Distribution package state and release documentation | Whether the expected kernel package is installed and how its version maps to the distribution’s kernel. |
| Is a particular vulnerability addressed? | The vendor advisory and installed package state for that CVE | Whether the vendor identifies the installed package as remediated, accounting for backports where applicable. |
| Can a reboot be deferred? | Vendor live-patching eligibility and service notices | Whether a specific live-patch service supports this kernel and fix; it does not prove all kernel updates can avoid a reboot. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
