Kernel age

What it inspects

/proc/version, from which it reads the kernel build date (for example `Wed Apr 19 08:22:18 UTC 2023`, or a Debian-style `(2024-11-01)`). Up to 180 days old passes, 181 to 365 days warns, and more than 365 days fails. If /proc/version cannot be read or has no recognisable date, the check is skipped.

Why it matters

Kernel security fixes only take effect once the new kernel is running. An old build date usually means updates were installed but never rebooted into, or never installed at all, so known local privilege escalation and network bugs are still open on this machine. Distributions rebuild kernels often, so a kernel older than a year is rarely current.

How to verify

uname -r; cat /proc/version

How to fix

Install the newest kernel with a full package upgrade, then reboot in a maintenance window. The reboot is a judgement step because it is downtime.

# Installs the newest kernel your distro ships, together with every other pending update.
# Nothing reboots here: the running kernel only changes after the reboot in the next step.
# If a configuration-file prompt appears, keeping your current version is the safe answer.
apt-get update
apt-get -y upgrade --with-new-pkgs

# Installs the newest kernel your distro ships, together with every other pending update.
# Nothing reboots here: the running kernel only changes after the reboot in the next step.
dnf -y upgrade --refresh

References

• Debian security information
• apt-get(8) manual page