Linux Kernel CVE Checker

Paste one line of uname -a. See the CVEs against the kernel your server is actually booting.

Prints one line. Reads nothing but the kernel it is running on.

uname -a

uname -r works too, though on Debian the full uname -a is the only form that carries the version its advisories use. Your hostname is dropped before anything is stored or logged.

We work it out from the kernel string. Set it if we get it wrong, or if we ask.

Why the running kernel, and not the installed ones

A Debian or Ubuntu server keeps every kernel it has ever installed - the ABI version is part of the package name, so an upgrade adds a package rather than replacing one, and nothing removes the old ones. A RHEL box keeps three by design. Exactly one of them is executing.

A package scan cannot tell them apart. It reports CVEs against all of them, including kernels the machine will never boot again. On one fleet we measured, that was the difference between 10.4 million findings and the handful that actually described the running systems.

This tool asks the narrower question. uname -a names the kernel that is executing right now, and the CVEs below are the ones published against it - the ones an attacker on that machine would get to use.

What we don't keep: your hostname. uname -a prints it, we read past it to reach the kernel release, and nothing downstream ever sees it - not the result page, not the logs, not our error reporting.

For everything else installed on the machine, the Linux package vulnerability scanner is the companion to this one, and continuous vulnerability scanning runs both on every server without the pasting.

FAQ

How do I check my Linux kernel for CVEs? +
Run `uname -a` on the server and paste the single line it prints. We read the kernel release out of it, work out which distribution and release it belongs to, and list the CVEs published against that kernel, sorted by severity, with the version that fixes each one. Nothing is installed and nothing is stored.
Why check the running kernel instead of the installed kernel packages? +
Because they are usually not the same thing. A Debian or Ubuntu machine keeps every kernel it has ever installed (the ABI version is part of the package name), and a RHEL machine keeps three by default, but exactly one is executing. A package scan reports CVEs against all of them, including kernels nothing boots. `uname -a` names the one that is actually running, which is the one an attacker gets.
Do I need to reboot after a kernel update? +
Yes, unless you use live patching. Installing a new kernel package changes what is on disk; the running kernel stays exactly as it was until the machine reboots into the new one. That gap is the single most common reason a server shows as patched and is still exploitable, and it is precisely what this tool measures.
Why does the tool say it cannot match my kernel? +
Because the release string carries no distribution marker: vanilla kernels built from kernel.org, Raspberry Pi and WSL2 kernels, and Proxmox VE kernels all use their own versioning that no distribution advisory feed is published against. Comparing them to a distro feed would produce numbers rather than answers, so we say so instead. The package vulnerability scanner works on those machines.
What does "fixed at your ABI" mean on an Ubuntu result? +
Ubuntu publishes kernel fixes against a version like 5.15.0-89.99, where 89 is the ABI and 99 is the upload number. `uname -r` prints the ABI but not the upload, so for advisories fixed at the ABI you are already running we cannot tell from one line whether your build includes them. Those are listed separately rather than counted as open or quietly dropped. Run the package scanner, or check `dpkg -l 'linux-image-*'`, to resolve them.
Where does the CVE data come from? +
The OSV (Open Source Vulnerabilities) database, which aggregates the per-distribution advisory feeds: Debian Security Advisories, Ubuntu Security Notices, Red Hat Errata, Alpine secdb and the Arch security tracker. The same data backs the continuous scanning Fivenines runs for paying customers, including a per-host callout for kernels that are installed but not booted.

Installing a kernel isn't running one.

Fivenines watches the booted kernel on every server you run, tells you when a new CVE lands against it, and flags the machines holding a patched kernel they never rebooted into. 14-day trial, no credit card.

Start free trial

14-day trial. No credit card required.