---
title: "HOST-PKG-005 Running Kernel Older Than Installed Kernel"
canonical: https://openvapt.com/checks/HOST-PKG-005.html
html: https://openvapt.com/checks/HOST-PKG-005.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-PKG-005 Running Kernel Older Than Installed Kernel

Checks that the kernel in memory is the newest kernel installed, so kernel security fixes are actually in effect.

- Domain: Server
- Severity: Medium
- Control category: Patch and Vulnerability Management
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`
- CIS Controls v8: 7.4
- NIST CSF 2.0: ID.RA-01, PR.PS-02
- CWE: CWE-1104
- OWASP Top 10 2021: A06:2021
- NIST SP 800-53 Rev. 5: SI-2, RA-5
- Benchmark topic: Apply installed kernel updates (CIS Controls v8 7.4) (topic only, no benchmark text)

## Why It Matters

A kernel update protects nothing until the machine boots into it. The package manager reports the update as installed, so the gap is invisible unless the running version is compared with the installed one. HOST-UPD-002 reads the Debian reboot marker; this check works on every distribution by comparing versions.

## How It Detects

Runs the allow-listed command uname -r and compares it with the installed kernel versions (linux-image-<version> packages, or kernel and kernel-core from rpm -qa). If the newest installed version is newer than the running one, the check fails. Incomplete when the running version or the package list cannot be read; skipped when no kernel package is installed.

## How to Fix

Schedule a maintenance window and reboot into the newest kernel. Where downtime is a problem, use the distribution's live patching service and still plan regular reboots.

## How to Verify

```
uname -r  should match the newest version in  dpkg -l 'linux-image-*' | grep ^ii  or  rpm -q kernel-core .
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)
- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning](https://csrc.nist.gov/pubs/sp/800/40/r4/final)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pkg_depth.go

Run it: `openvapt scan --only HOST-PKG-005`. Read it offline: `openvapt explain HOST-PKG-005`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-PKG-005.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.