Updating the Linux Kernel: Why and How to Do It Safely

The Linux kernel is the core component of the OS. Updating it regularly closes critical vulnerabilities (Spectre, Meltdown, Dirty Cow), adds support for new hardware, and improves performance.

Checking the Current Kernel Version

# Kernel version
uname -r

# Full information
uname -a

# All installed kernels
dpkg --list | grep linux-image

# Sample output:
# 6.5.0-26-generic  — current
# 6.5.0-21-generic  — old (will be removed)

Updating the Kernel via apt (Ubuntu/Debian)

# A standard upgrade includes the kernel
sudo apt update
sudo apt full-upgrade -y

# Check the available kernel versions
apt-cache search linux-image | grep generic

# Install a specific version
sudo apt install linux-image-6.8.0-31-generic -y

# YOU MUST reboot for the change to take effect
sudo reboot

Verifying After the Reboot

# Make sure the new kernel has loaded
uname -r

# Check for module problems
dmesg | grep -i error | head -20

Rolling Back to the Previous Kernel via GRUB

If the new kernel caused problems:

1. While rebooting, hold Shift (Legacy BIOS) or Esc (UEFI) to enter GRUB
2. Choose Advanced options for Ubuntu
3. Choose the previous kernel version
4. Once it boots successfully, remove the problematic kernel:

sudo apt remove linux-image-6.8.0-31-generic
sudo update-grub

Installing a Mainline Kernel (for Advanced Users)

# Ubuntu Mainline Kernel PPA (Canonical)
# Lets you install the newest kernels
sudo add-apt-repository ppa:cappelikan/ppa
sudo apt update
sudo apt install mainline

# Use the GUI utility to pick and install the version you need

Diagnosing common kernel update errors

After updating the kernel, the server does not boot and drops into GRUB rescue — most often this means the new kernel failed to build an initramfs with the needed modules (for example the virtio virtual disk driver on a VPS).

error: no such device: /dev/sda1
Entering rescue mode...
grub rescue>

Through the hosting console (VNC/KVM), boot the old kernel from the GRUB menu, then rebuild the initramfs for the new one: sudo update-initramfs -u -k 6.8.0-31-generic, and only after that succeeds try booting the new kernel again.

"Warning: Kernel is too old" or a module fails to load after an update — third-party kernel modules (VirtualBox, NVIDIA, ZFS via DKMS) are built for a specific headers version and do not rebuild automatically during an apt update if the headers package does not match.

modprobe: ERROR: could not insert 'zfs': Invalid argument
dmesg | tail
ZFS: module license 'CDDL' taints kernel

Install the headers for the new version (sudo apt install linux-headers-$(uname -r)) and rebuild the module: sudo dkms autoinstall. Without this step, DKMS modules stay tied to the old kernel.

Kernel update methods compared

When updating the kernel should wait

• The server uses specific kernel modules (proprietary drivers, ZFS, custom network modules) with no ready build for the new version — check module compatibility in a test environment first.
• Peak load is coming up soon (a sale, a release) — a reboot to apply the new kernel risks downtime at exactly the wrong moment.
• There is no access to the hosting console (VNC/KVM) in case the server fails to come back up after reboot — without that access, recovering from a failed kernel update can mean contacting hosting support and a long wait.

Verifying the result

1. Check the active version: uname -r must match the version you installed.
2. Confirm the old kernel is still in GRUB as a fallback: awk -F"'" '/menuentry / {print $2}' /boot/grub/grub.cfg must list both versions.
3. Check for module errors: dmesg | grep -iE "error|fail" | head -20 — there should be no critical driver messages.
4. Check key services after reboot: systemctl --failed must return an empty list.

A kernel update often comes together with a full system update — see the article on upgrading between Debian versions and the general guide to updating the OS on a VDS.