Applies to: Ubuntu 24.04 LTS (GA kernel 6.8, HWE kernel 7.0) and Ubuntu 26.04 LTS (kernel 7.0), apt 2.8 and 3.2; kernel packages installed and upgraded in test containers (not booted)
On Ubuntu, the kernel is updated like any other package: run sudo apt update and sudo apt upgrade, then reboot. The new kernel is installed next to the old one and only starts being used after the reboot, so check with uname -r afterwards. Use apt upgrade or apt full-upgrade, not apt-get upgrade: the older command holds new kernels back.
1. Check which kernel you run now
uname -r
On Ubuntu 24.04 with the standard kernel this prints something like 6.8.0-146-generic. Our guide how to check the kernel version explains the numbers and how to list every installed kernel.
2. See whether a kernel update is waiting
sudo apt update apt list --upgradable 2>/dev/null | grep linux
In our test, on a system with the original 24.04 kernel installed, it showed:
linux-image-virtual/noble-updates,noble-security 6.8.0-146.146 amd64 [upgradable from: 6.8.0-31.31]
linux-image-virtual (or linux-image-generic, linux-generic) is a metapackage: it always depends on the newest kernel of its series. A new kernel version is a new package (here linux-image-6.8.0-146-generic), which is why the way you upgrade matters.
3. Install the update
sudo apt upgrade
apt upgrade installs new packages that upgrades need, so it brings in the new kernel. apt-get upgrade doesn’t, and holds the kernel back:
$ sudo apt-get upgrade ... The following packages have been kept back: linux-image-virtual
If you see “kept back” for kernel packages, run sudo apt full-upgrade (or sudo apt upgrade). Ubuntu also releases some updates in phases, and apt then reports them as “deferred due to phasing”; a later upgrade installs them once they reach your server.
When the kernel installs, the output ends with lines like these:
Setting up linux-image-6.8.0-146-generic (6.8.0-146.146) ... I: /boot/vmlinuz is now a symlink to vmlinuz-6.8.0-146-generic I: /boot/initrd.img is now a symlink to initrd.img-6.8.0-146-generic
For safe update habits in general (snapshots, reading what will change, holding packages), see how to update all packages on Linux safely.
4. Reboot into the new kernel
Ubuntu marks that a restart is needed:
$ cat /run/reboot-required *** System restart required ***
Reboot when it suits your services (reboot from the command line, or from the Ucartz client area for a VPS). After the reboot, uname -r must show the new version. If it still shows the old one, the new kernel was not installed or the server booted an older entry.
5. Remove old kernels
Old kernels stay installed after an upgrade, so you can still boot one if the new kernel causes a problem. Remove the ones you no longer need with:
sudo apt autoremove --purge
In our test three kernels were installed (6.8.0-31, 6.8.0-146 and the HWE kernel 7.0.0-38), and apt removed only the oldest:
The following packages will be REMOVED: linux-image-6.8.0-31-generic* linux-modules-6.8.0-31-generic*
According to the apt.conf manual, apt keeps two kernels by default and “will always keep the running kernel and the latest one”. Let apt choose; removing kernel packages by hand risks deleting the one you are running.
HWE kernels: a newer kernel on an LTS release
Each LTS release has a GA kernel (the one it was released with) and, later, HWE (hardware enablement) kernels that bring newer kernel versions for new hardware. According to Ubuntu’s kernel lifecycle page, “Server installations will default to the GA kernel and provide the enablement kernel as optional”, while Desktop installations of 24.04 track the HWE kernel. In our Ubuntu 24.04 test:
- GA:
linux-generic6.8.0-146 (Linux 6.8) - HWE:
linux-generic-hwe-24.047.0.0-38~24.04.4 (Linux 7.0, the kernel of Ubuntu 26.04)
To switch a 24.04 server to the HWE kernel:
sudo apt install --install-recommends linux-generic-hwe-24.04 sudo reboot
In our test the HWE package installed linux-image-7.0.0-38-generic next to the 6.8 kernels and made it the default (I: /boot/vmlinuz is now a symlink to vmlinuz-7.0.0-38-generic).
On Ubuntu 26.04 the package linux-generic-hwe-26.04 already exists, but in our test it pointed to the same 7.0.0-38 kernel as the GA package linux-generic, so there is nothing to switch yet.
A server that runs well doesn’t need HWE. Consider it when new hardware is not fully supported by the GA kernel, or when software needs a newer kernel feature.
Automatic kernel updates and Livepatch
Ubuntu’s unattended-upgrades installs security updates, kernel included, and removes unused kernels, but it doesn’t reboot by default: Unattended-Upgrade::Automatic-Reboot is "false" in /etc/apt/apt.conf.d/50unattended-upgrades on 24.04 and 26.04. To reboot automatically at a quiet time when an update needs it, set:
Unattended-Upgrade::Automatic-Reboot "true"; Unattended-Upgrade::Automatic-Reboot-Time "02:00";
If you can’t reboot often, Canonical Livepatch applies critical and high kernel security fixes while the server runs. According to Ubuntu, it is free for up to 5 machines for personal use with an Ubuntu Pro token (sudo pro attach TOKEN, then sudo pro enable livepatch), and it is “not a replacement for rebooting”. See also applying kernel patches without rebooting.
If the new kernel doesn’t boot
Because the previous kernel stays installed, you can start it from the GRUB boot menu. Ubuntu hides that menu by default (GRUB_TIMEOUT_STYLE=hidden and GRUB_TIMEOUT=0 in its default /etc/default/grub), so on a server it helps to make it visible before a kernel update:
- In
/etc/default/grub, set:GRUB_TIMEOUT_STYLE=menu GRUB_TIMEOUT=5
- Apply it with
sudo update-grub.
If the server doesn’t come back after the reboot, open its console: the VNC console in Virtualizor for a VPS (how to access your VPS via VNC) or the IPMI console for a dedicated server (Supermicro IPMI console). In the GRUB menu choose Advanced options for Ubuntu and select the previous kernel. Keep using it until a fixed kernel update is available. Changing kernel parameters at the GRUB menu helps when a single boot option is the cause.
Mainline kernels
Ubuntu’s kernel team also publishes “mainline” builds of the newest upstream kernels. According to the kernel team, they are built for debugging, are unsupported and get no security updates. Don’t install them on a server; use the GA or HWE kernel from the Ubuntu archive.
Other distributions
- Debian 13: the kernel comes through the metapackage
linux-image-amd64(6.12.111 in our test). Runsudo apt update && sudo apt full-upgrade, then reboot. - AlmaLinux 10:
sudo dnf upgradeinstalls a newkernelpackage (6.12.0-211.64.1.el10_2 was the newest in our test) next to the old ones, then you reboot. DNF keeps three kernels (installonly_limit=3in/etc/dnf/dnf.conf).
Official documentation: Ubuntu kernel lifecycle and Livepatch.
