Check Linux Kernel Version & Find CVE Fix

This guide shows you how to check your Linux kernel version and then locate the specific fix for a known CVE (Common Vulnerabilities and Exposures) that affects it. You’ll learn the exact commands to identify your kernel, how to search for CVEs, and how to determine whether a patch is already applied or if you need to update. No prior security expertise is required, just basic comfort with the terminal.

What You’ll Need

A Linux system with terminal access (local or SSH).
Basic familiarity with running commands as a regular user (some commands may require sudo).
An internet connection to access CVE databases and vendor security pages.

Step-by-Step

Open a terminal. On most distributions, press Ctrl+Alt+T or find “Terminal� in your applications menu.
Check the kernel version. Run the following command: uname -r. This prints the kernel release, e.g., 5.15.0-91-generic. The number after the dash (if present) is a distribution-specific build identifier.
Get more detailed kernel info (optional). Use uname -a to see the full kernel string including hostname, architecture, and build date. For the kernel’s exact version (like 5.15.0), you can also run cat /proc/version.
Identify your distribution and version. This matters because the same kernel version can have different patch levels across distros. Run one of these:
cat /etc/os-release (works on most modern distros)
lsb_release -a (if installed)
hostnamectl (on systemd-based systems).
Search for CVEs affecting your kernel. Go to the NIST NVD or Ubuntu CVE tracker (or your distro’s equivalent). In the search box, enter your kernel version (e.g., 5.15.0) and the word “kernel�. For example, on Ubuntu, you can use ubuntu-security-status to list known CVEs affecting installed packages.
Use the distro’s security tracker. Most major distros provide a searchable database. For example:
– Ubuntu: ubuntu.com/security/cves – search by CVE ID or package name.
– Debian: security-tracker.debian.org.
– Red Hat / Fedora: access.redhat.com/security.
– Arch: security.archlinux.org.
Check if your kernel is vulnerable. The CVE page will list affected versions and patched versions. Compare your kernel version (from step 2) with the “fixed in� version. If your version is lower, you are likely vulnerable.
Find the fix. The CVE page usually links to the patch commit (e.g., on kernel.org or a distro’s git repository). For example, a CVE might say “Fixed in kernel 5.15.30�. That means you need to update to at least that version.
Update your kernel. Use your package manager:
– Debian/Ubuntu: sudo apt update && sudo apt upgrade linux-image-generic
– Fedora: sudo dnf upgrade kernel
– Arch: sudo pacman -Syu
– openSUSE: sudo zypper update kernel
After updating, reboot to load the new kernel.
Verify the new kernel version. Run uname -r again to confirm the version is now above the “fixed in� version.
If you cannot update immediately, apply a workaround. Some CVEs have temporary mitigations (e.g., disabling a kernel module, changing sysctl settings). Check the CVE page or your distro’s security advisory for such options. For example, for some network-related CVEs, you might disable a specific protocol via sysctl.

Common Mistakes

Ignoring the distribution’s patch level. The kernel version from uname -r might be e.g., 5.15.0, but your distro has backported security fixes to that version. Always check your distro’s security tracker, not just the upstream kernel version.
Assuming all CVEs require a kernel update. Some CVEs are only exploitable with local access or require specific hardware. Read the CVE description to understand the risk.
Not rebooting after updating. The new kernel won’t be active until you reboot. Running an old kernel after update gives a false sense of security.
Using an unsupported kernel version. If you compiled your own kernel or use an old LTS, you may not get security patches. Stick to your distro’s supported kernel.
Confusing kernel version with distribution version. The kernel version is not the same as Ubuntu 22.04 or Fedora 38. The kernel version is the number like 6.2.0.

Tips

Automate CVE checking. Tools like ubuntu-security-status (Ubuntu) or dnf updateinfo --list (Fedora) can list pending security updates.
Subscribe to your distro’s security alerts. Most distros have mailing lists or RSS feeds.
Use the CVE ID directly. When you hear about a CVE, search for the exact ID (e.g., CVE-2023-32233) on your distro’s tracker to see if you’re affected.
Keep a backup of your current kernel. Before a major kernel update, ensure you can boot into the old one if something goes wrong. Most distros keep the previous kernel in the bootloader menu.
Check for live patches. Some enterprise distros offer live kernel patching (e.g., Canonical Livepatch, Red Hat kpatch) that applies critical security fixes without rebooting. This is useful for systems that cannot reboot often.

Troubleshooting

The CVE page says “Fixed in 5.15.30� but my distro says 5.15.0-91 is patched. This is normal. Distros backport specific security fixes to their kernel packages. Check your distro’s security advisory for that CVE to see if the fix is included in your current package version.
I updated but uname -r shows the old version. You likely haven’t rebooted. Reboot, then check again. If it still shows old, the bootloader may be pointing to the old kernel. Check your bootloader configuration (e.g., GRUB) and select the new kernel.
The update command fails with “package not found�. Ensure your package repositories are up to date. Run sudo apt update (or equivalent) first. If the package name is wrong, search for the correct kernel package name using apt search linux-image or dnf search kernel.
I can’t find any CVE for my exact kernel version. Some CVEs affect a range of versions. Use the CVE’s “affected versions� list and compare with your kernel version. If your version is in the range, you’re affected.
I applied a workaround but it didn’t help. Workarounds are often partial. They may reduce the attack surface but not fully fix the issue. The only reliable fix is to update to a patched kernel.

Frequently Asked Questions

How do I check if my kernel is vulnerable to a specific CVE?

Search the CVE ID on your distribution’s security tracker (e.g., Ubuntu CVE tracker). It will show the status for each supported release, including whether your kernel version is affected and which package version contains the fix.

What does the kernel version number mean?

The format is X.Y.Z, where X is the major version, Y is the minor (feature) version, and Z is the patch (security/bugfix) level. For example, 6.5.3 means major 6, minor 5, patch 3.

Do I need to update the kernel for every CVE?

Not necessarily. Some CVEs may not be exploitable in your environment (e.g., require local access when you only have remote users). However, for remote, easily exploitable CVEs, updating is strongly recommended. Check the CVSS score and attack vector.

Can I fix a kernel CVE without updating the whole kernel?

Sometimes yes. You can apply a specific patch manually if you compile your own kernel, but that’s complex and not recommended for most users. Live patching services (like Canonical Livepatch) can apply critical fixes without a reboot, but they are limited to certain vulnerabilities and require a subscription.

Why does my distro not use the latest kernel version?

Distributions often use older kernels but backport security fixes to them to maintain stability and compatibility with their software. This is why a distro’s 5.15 kernel may be patched against a CVE that is fixed in upstream 6.1.

How often should I check for kernel updates?

At least once a week, or enable automatic security updates. Many distros offer automatic updates for security patches; you can configure that via your package manager or a tool like unattended-upgrades (Debian/Ubuntu).

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →