Kernel updates fix security holes in the most privileged part of the system. On servers, the right approach is almost always to use your distribution’s kernel updates and reboot into them regularly. You rarely need to compile anything. This guide covers the routine, the options for newer kernels, and how to recover if a new kernel misbehaves.

Check what you’re running

uname -r
cat /var/run/reboot-required 2>/dev/null      # Ubuntu/Debian
sudo dnf needs-restarting -r                  # RHEL family

See uname and kernel versions.

Ubuntu/Debian:

sudo apt update
sudo apt full-upgrade        # installs new kernel packages (upgrade may hold them back)
sudo reboot

RHEL, Rocky, AlmaLinux:

sudo dnf upgrade --refresh
sudo reboot

After the reboot, uname -r should show the new version. The update is only effective after a reboot. A server with months of uptime and pending kernel updates is still running the vulnerable kernel.

Reboot safely

  1. Make sure services start on boot: systemctl is-enabled nginx mysql php8.3-fpm.
  2. Check that /etc/fstab is valid (sudo findmnt --verify). A bad fstab line is the most common reason a server doesn’t come back. See fstab.
  3. Have your provider’s VNC console ready in case of trouble.
  4. Reboot in a quiet period. On a VPS, reboots usually take under a minute.

Unattended upgrades can install kernel updates automatically, and can also reboot at a fixed time (Unattended-Upgrade::Automatic-Reboot "true"; …-Time "04:00";). See unattended upgrades.

Need a newer kernel?

Sometimes you need features or hardware support from a newer kernel. Stay within supported packages.

Ubuntu LTS — HWE kernel. The Hardware Enablement stack brings newer kernels from later Ubuntu releases to an LTS, with security support:

sudo apt install --install-recommends linux-generic-hwe-24.04
sudo reboot

Debian — backports:

echo "deb http://deb.debian.org/debian bookworm-backports main" | sudo tee /etc/apt/sources.list.d/backports.list
sudo apt update
sudo apt install -t bookworm-backports linux-image-amd64

RHEL family — ELRepo provides mainline (kernel-ml) and long-term (kernel-lt) kernels. These are third-party and not covered by Red Hat support. Use them only when needed.

Avoid on production: random mainline .deb builds (e.g. Ubuntu’s mainline PPA builds), which get no security updates, and self-compiled kernels, unless you’re prepared to maintain them.

Remove old kernels

Each kernel takes space in /boot and /lib/modules. On systems with a small /boot partition, old kernels can fill it and break updates.

Ubuntu/Debian:

sudo apt autoremove --purge

This keeps the running kernel and the previous one as a fallback.

RHEL family keeps the last three by default (installonly_limit=3 in /etc/dnf/dnf.conf):

sudo dnf remove --oldinstallonly --setopt installonly_limit=2 kernel

Never remove the kernel you’re currently running.

If the new kernel causes problems

Boot the previous kernel from GRUB:

  1. Open the VNC console and reboot.
  2. In the GRUB menu, choose Advanced options (Ubuntu/Debian) and select the previous kernel. If the menu doesn’t appear, hold Shift (BIOS) or press Esc (UEFI) during boot.
  3. Once the system is up, investigate: journalctl -b -1 -p err, plus third-party modules that failed to build (DKMS: ZFS, NVIDIA, VirtualBox).

To make the older kernel the default until fixed, see GRUB bootloader.

DKMS modules

Out-of-tree modules (ZFS on Debian, WireGuard on old kernels, some drivers) are rebuilt for each new kernel by DKMS. If that build fails, the module is missing after the reboot. Check before rebooting:

dkms status

Live patching: fewer reboots

For systems where reboots are expensive:

  • Ubuntu Livepatch (part of Ubuntu Pro, free for a small number of machines): sudo pro enable livepatch.
  • kpatch on RHEL; KernelCare (commercial) on many distributions.

Live patches cover critical security fixes only. You still need to reboot into new kernels periodically.

Quick reference

Task Command
Running kernel uname -r
Update (Ubuntu/Debian) sudo apt full-upgrade && sudo reboot
Update (RHEL) sudo dnf upgrade && sudo reboot
Reboot needed? /var/run/reboot-required / dnf needs-restarting -r
Ubuntu HWE kernel apt install linux-generic-hwe-24.04
Remove old kernels apt autoremove --purge
DKMS status dkms status

Related: apt update errors and Linux server hardening.

  • Linux
  • Kernel
  • Security